Bug 2034914 (CVE-2021-45042)

Summary:	CVE-2021-45042 vault: clusters using the integrated storage backend allowed an authenticated user to cause a DoS of the storage backend
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amctagga, etamir, godas, gparvin, hchiramm, hvyas, jarrpa, jburrell, jcantril, kaycoth, madam, nbecker, njean, pahickey, sostapov, stcannon, tnielsen, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	vault 1.7.7, vault 1.8.6, vault 1.9.1	Doc Type:	If docs needed, set a value
Doc Text:	A denial of service attack was discovered against vault. For clusters using the Integrated Storage (Raft) backend, an authenticated user with write permissions to the KV secrets engine can cause a panic leading to a denial of service of the storage backend, by supplying a key larger than 32KB.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2034915

Description Guilherme de Almeida Suckevicz 2021-12-22 13:36:55 UTC

In HashiCorp Vault and Vault Enterprise before 1.7.7, 1.8.x before 1.8.6, and 1.9.x before 1.9.1, clusters using the Integrated Storage backend allowed an authenticated user (with write permissions to a kv secrets engine) to cause a panic and denial of service of the storage backend. The earliest affected version is 1.4.0.

Reference:
https://discuss.hashicorp.com/t/hcsec2-21-33-vault-s-kv-secrets-engine-with-integrated-storage-exposed-to-authenticated-denial-of-service/33157

Comment 2 Hardik Vyas 2021-12-28 14:06:10 UTC

Upstream fix: https://github.com/hashicorp/vault/commit/859cf45d05b40b2cd13f8696acc68a3754402ffc