CVE-2018-19786
published 2018-12-05CVE-2018-19786: HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the…
PriorityP336high8.1CVSS 3.0
AVNACHPRNUINSUCHIHAH
EPSS
0.93%
56.3th percentile
HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hashicorp | vault | < 1.0.0 | 1.0.0 |
CVSS provenance
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_redhat8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
vault: writes the master key to the server log
vendor_redhat·2018-12-05·CVSS 8.1
CVE-2018-19786 [HIGH] CWE-532 vault: writes the master key to the server log
vault: writes the master key to the server log
HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported.
A flaw was found in HashiCorp Vault, which could provide weaker-than-expected security, caused by a flaw in the autoseal mechanism. This flaw allows a remote attacker to launch further attacks on the system.
Package: openshift-logging/logging-loki-rhel9 (Logging Subsystem for Red Hat OpenShift) - Not affected
Package: openshift4/ose-installer (Red Hat OpenShift Container Platform 4) - Not affected
Package: openshift4/topology-aware-lifecycle-manager-rhel8-operator (Red Hat OpenShift Container Platform 4) - Not affected
Package: ocs4/ce
GHSA
GHSA-5jfh-x25r-v632: HashiCorp Vault before 1
ghsa_unreviewed·2022-05-14
CVE-2018-19786 [HIGH] CWE-532 GHSA-5jfh-x25r-v632: HashiCorp Vault before 1
HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autoseal mechanism without an error being reported.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-12-05
Published