CVE-2021-32923: Insufficient Session Expiration

June 8, 2021 (updated June 17, 2021)

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.

References

github.com/advisories/GHSA-38j9-7pp9-2hjw
nvd.nist.gov/vuln/detail/CVE-2021-32923

Code Behaviors & Features

Detect and mitigate CVE-2021-32923 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →