CVE-2021-42135: Incorrect Authorization

October 12, 2021 (updated October 20, 2021)

HashiCorp Vault and Vault Enterprise 1.8.x through 1.8.4 may have an unexpected interaction between glob-related policies and the Google Cloud secrets engine. Users may, in some situations, have more privileges than intended, e.g., a user with read permission for the /gcp/roleset/* path may be able to issue Google Cloud service account credentials.

References

github.com/advisories/GHSA-362v-wg5p-64w2
github.com/hashicorp/vault/blob/main/CHANGELOG.md
nvd.nist.gov/vuln/detail/CVE-2021-42135

Code Behaviors & Features

Detect and mitigate CVE-2021-42135 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →