CVE-2020-10661: HashiCorp Vault Improper Privilege Management

January 30, 2024 (updated September 16, 2024)

HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4.

References

github.com/advisories/GHSA-j6vv-vv26-rh7c
github.com/hashicorp/vault
github.com/hashicorp/vault/blob/master/CHANGELOG.md
github.com/hashicorp/vault/commit/18485ee9d4352ac8e8396c580b5941ccf8e5b31a
nvd.nist.gov/vuln/detail/CVE-2020-10661
www.hashicorp.com/blog/category/vault

Code Behaviors & Features

Detect and mitigate CVE-2020-10661 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →