Gentoo: GLSA-202207-01: HashiCorp Vault: Multiple Vulnerabilities |...

Advisories

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory                           GLSA 202207-01
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
                                           https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

 Severity: Low
    Title: HashiCorp Vault: Multiple Vulnerabilities
     Date: July 29, 2022
     Bugs: #768312, #797244, #808093, #817269, #827945, #829493, #835070, #845405
       ID: 202207-01

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been discovered in HashiCorp Vault, the
worst of which could result in denial of service.

Background
==========

HashiCorp Vault is a tool for managing secrets.

Affected packages
=================

    -------------------------------------------------------------------
     Package              /     Vulnerable     /            Unaffected
    -------------------------------------------------------------------
  1  app-admin/vault            < 1.10.3                    >= 1.10.3 

Description
===========

Multiple vulnerabilities have been discovered in HashiCorp Vault. Please
review the CVE identifiers referenced below for details.

Impact
======

Please review the referenced CVE identifiers for details.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All HashiCorp Vault users should upgrade to the latest version:

  # emerge --sync
  # emerge --ask --oneshot --verbose ">=app-admin/vault-1.10.3"

References
==========

[ 1 ] CVE-2020-25594
      https://nvd.nist.gov/vuln/detail/CVE-2020-25594
[ 2 ] CVE-2021-27668
      https://nvd.nist.gov/vuln/detail/CVE-2021-27668
[ 3 ] CVE-2021-3024
      https://nvd.nist.gov/vuln/detail/CVE-2021-3024
[ 4 ] CVE-2021-3282
      https://nvd.nist.gov/vuln/detail/CVE-2021-3282
[ 5 ] CVE-2021-32923
      https://nvd.nist.gov/vuln/detail/CVE-2021-32923
[ 6 ] CVE-2021-37219
      https://nvd.nist.gov/vuln/detail/CVE-2021-37219
[ 7 ] CVE-2021-38553
      https://nvd.nist.gov/vuln/detail/CVE-2021-38553
[ 8 ] CVE-2021-38554
      https://nvd.nist.gov/vuln/detail/CVE-2021-38554
[ 9 ] CVE-2021-41802
      https://nvd.nist.gov/vuln/detail/CVE-2021-41802
[ 10 ] CVE-2021-43998
      https://nvd.nist.gov/vuln/detail/CVE-2021-43998
[ 11 ] CVE-2021-45042
      https://nvd.nist.gov/vuln/detail/CVE-2021-45042
[ 12 ] CVE-2022-25243
      https://nvd.nist.gov/vuln/detail/CVE-2022-25243
[ 13 ] CVE-2022-30689
      https://nvd.nist.gov/vuln/detail/CVE-2022-30689

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

 https://security.gentoo.org/glsa/202207-01

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
[email protected] or alternatively, you may file a bug at
https://bugs.gentoo.org.

License
=======

Copyright 2022 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5

Gentoo: GLSA-202207-01: HashiCorp Vault: Multiple Vulnerabilities

Summary

Multiple vulnerabilities have been discovered in HashiCorp Vault. Please review the CVE identifiers referenced below for details.

Resolution

All HashiCorp Vault users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-admin/vault-1.10.3"

References

[ 1 ] CVE-2020-25594 https://nvd.nist.gov/vuln/detail/CVE-2020-25594 [ 2 ] CVE-2021-27668 https://nvd.nist.gov/vuln/detail/CVE-2021-27668 [ 3 ] CVE-2021-3024 https://nvd.nist.gov/vuln/detail/CVE-2021-3024 [ 4 ] CVE-2021-3282 https://nvd.nist.gov/vuln/detail/CVE-2021-3282 [ 5 ] CVE-2021-32923 https://nvd.nist.gov/vuln/detail/CVE-2021-32923 [ 6 ] CVE-2021-37219 https://nvd.nist.gov/vuln/detail/CVE-2021-37219 [ 7 ] CVE-2021-38553 https://nvd.nist.gov/vuln/detail/CVE-2021-38553 [ 8 ] CVE-2021-38554 https://nvd.nist.gov/vuln/detail/CVE-2021-38554 [ 9 ] CVE-2021-41802 https://nvd.nist.gov/vuln/detail/CVE-2021-41802 [ 10 ] CVE-2021-43998 https://nvd.nist.gov/vuln/detail/CVE-2021-43998 [ 11 ] CVE-2021-45042 https://nvd.nist.gov/vuln/detail/CVE-2021-45042 [ 12 ] CVE-2022-25243 https://nvd.nist.gov/vuln/detail/CVE-2022-25243 [ 13 ] CVE-2022-30689 https://nvd.nist.gov/vuln/detail/CVE-2022-30689

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/202207-01

Concerns

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to [email protected] or alternatively, you may file a bug at https://bugs.gentoo.org.

Severity
Severity: Low
Title: HashiCorp Vault: Multiple Vulnerabilities
Date: July 29, 2022
Bugs: #768312, #797244, #808093, #817269, #827945, #829493, #835070, #845405
ID: 202207-01

Synopsis

Multiple vulnerabilities have been discovered in HashiCorp Vault, the worst of which could result in denial of service.

Background

HashiCorp Vault is a tool for managing secrets.

Affected Packages

------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-admin/vault < 1.10.3 >= 1.10.3

Impact

Please review the referenced CVE identifiers for details.

Workaround

There is no known workaround at this time.

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.