CVE-2020-25816: Token leases could outlive their TTL in HashiCorp Vault
(updated )
HashiCorp Vault and Vault Enterprise 1.0 before 1.5.4 have Incorrect Access Control.
References
- github.com/advisories/GHSA-57gg-cj55-q5g2
- github.com/hashicorp/vault
- github.com/hashicorp/vault/blob/master/CHANGELOG.md
- github.com/hashicorp/vault/blob/master/CHANGELOG.md
- github.com/hashicorp/vault/pull/10020/commits/f192878110fe93eb13da914b2bee28caa7866a29
- nvd.nist.gov/vuln/detail/CVE-2020-25816
- www.hashicorp.com/blog/category/vault
Code Behaviors & Features
Detect and mitigate CVE-2020-25816 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →