CVE-2021-45042
published 2021-12-17CVE-2021-45042: In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an…
PriorityP422medium4.9CVSS 3.1
AVNACLPRHUINSUCNINAH
EPSS
1.41%
69.2th percentile
In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user (with write permissions to a kv secrets engine) to cause a panic and denial of service of the storage backend. The earliest affected version is 1.4.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| hashicorp | vault | — | — |
| hashicorp | vault | >= 1.4.0 < 1.7.7 | 1.7.7 |
| hashicorp | vault | >= 1.8.0 < 1.8.6 | 1.8.6 |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
nvdv2.06.8MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:C
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
vault: clusters using the integrated storage backend allowed an authenticated user to cause a DoS of the storage backend
vendor_redhat·2021-12-13·CVSS 4.9
CVE-2021-45042 [MEDIUM] CWE-400 vault: clusters using the integrated storage backend allowed an authenticated user to cause a DoS of the storage backend
vault: clusters using the integrated storage backend allowed an authenticated user to cause a DoS of the storage backend
In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user (with write permissions to a kv secrets engine) to cause a panic and denial of service of the storage backend. The earliest affected version is 1.4.0.
A denial of service attack was discovered against vault. For clusters using the Integrated Storage (Raft) backend, an authenticated user with write permissions to the KV secrets engine can cause a panic leading to a denial of service of the storage backend, by supplying a key larger than 32KB.
Package: openshift-logging/logging-loki-rhel9 (Logging S
GHSA
GHSA-cr6r-4g38-f69g: In HashiCorp Vault and Vault Enterprise before 1
ghsa_unreviewed·2021-12-18
CVE-2021-45042 [MEDIUM] GHSA-cr6r-4g38-f69g: In HashiCorp Vault and Vault Enterprise before 1
In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user (with write permissions to a kv secrets engine) to cause a panic and denial of service of the storage backend. The earliest affected version is 1.4.0.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://discuss.hashicorp.com/t/hcsec2-21-33-vault-s-kv-secrets-engine-with-integrated-storage-exposed-to-authenticated-denial-of-service/33157https://security.gentoo.org/glsa/202207-01https://www.hashicorp.com/blog/category/vaulthttps://discuss.hashicorp.com/t/hcsec2-21-33-vault-s-kv-secrets-engine-with-integrated-storage-exposed-to-authenticated-denial-of-service/33157https://security.gentoo.org/glsa/202207-01https://www.hashicorp.com/blog/category/vault
2021-12-17
Published