CVE-2021-38554: Improper Removal of Sensitive Information Before Storage or Transfer

August 30, 2021 (updated October 21, 2021)

HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.

References

github.com/advisories/GHSA-6239-28c2-9mrm
github.com/hashicorp/vault/releases/tag/v1.6.6
github.com/hashicorp/vault/releases/tag/v1.7.4
nvd.nist.gov/vuln/detail/CVE-2021-38554

Code Behaviors & Features

Detect and mitigate CVE-2021-38554 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →