Bug 1953030 (CVE-2021-27400)

Summary: CVE-2021-27400 vault: TLS certificates not validated when connecting to Cassandra clusters
Product: [Other] Security Response Reporter: Pedro Sampaio <psampaio>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: amctagga, etamir, gghezzo, gparvin, hchiramm, jarrpa, jcantril, jramanat, jweiser, jwendell, kconner, madam, muagarwa, nbecker, ocs-bugs, periklis, rcernich, sostapov, stcannon, thee, tnielsen, twalsh
Target Milestone: ---Keywords: Reopened, Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2023-02-16 13:41:53 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1953031    

Description Pedro Sampaio 2021-04-23 18:49:19 UTC 
HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1

References:

https://discuss.hashicorp.com/t/hcsec-2021-10-vault-s-cassandra-integrations-did-not-validate-tls-certificates/23463
Comment 1 Anten Skrabec 2021-05-03 21:53:44 UTC 
External References:

https://discuss.hashicorp.com/t/hcsec-2021-10-vault-s-cassandra-integrations-did-not-validate-tls-certificates/23463
Comment 2 Product Security DevOps Team 2021-05-04 20:33:56 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-27400
Comment 3 Product Security DevOps Team 2021-05-05 02:33:37 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-27400
Comment 4 Anten Skrabec 2021-05-11 20:16:37 UTC 
Upstream patch:
https://github.com/hashicorp/vault/pull/11365
Comment 5 Product Security DevOps Team 2023-02-16 13:41:50 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-27400