CVE-2023-5954 — Missing Release of Memory after Effective Lifetime in Hashicorp Vault

CWE-401 — Missing Release of Memory after Effective Lifetime6 documents4 sources
Severity
7.5HIGHNVD
OSV4.3
EPSS
0.6%
top 30.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Github.com Hashicorp VaultHashicorp VaultMozilla Firefox+1 more
Timeline
PublishedNov 9
Latest updateAug 21

Description

HashiCorp Vault and Vault Enterprise inbound client requests triggering a policy check can lead to an unbounded consumption of memory. A large number of these requests may lead to denial-of-service. Fixed in Vault 1.15.2, 1.14.6, and 1.13.10.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5hashicorp/vault_enterprise8 versions+7
▶NVDhashicorp/vault1.13.7 — 1.13.10+2
▶Gogithub.com/hashicorp_vault1.14.0 — 1.14.6+2
▶CVEListV5hashicorp/vault8 versions+7
▶Ubuntumozilla/firefox< 111.0.1+build2-0ubuntu0.18.04.1+1

🔴Vulnerability Details

4
OSV
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability in github.com/hashicorp/vault↗2024-08-21
▶
OSV
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability↗2023-11-09
▶
GHSA
HashiCorp Vault Missing Release of Memory after Effective Lifetime vulnerability↗2023-11-09
▶
OSV
firefox regressions↗2023-03-27
▶

📋Vendor Advisories

1
Red Hat
vault: inbound client requests can trigger a denial of service↗2023-11-09
▶