Bug 2135339 (CVE-2022-41316)

Summary:	CVE-2022-41316 vault: insufficient certificate revocation list checking
Product:	[Other] Security Response	Reporter:	Avinash Hanwate <ahanwate>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	etamir, gparvin, hchiramm, jburrell, jcantril, jramanat, madam, muagarwa, nbecker, njean, ocs-bugs, pahickey, periklis, sostapov, stcannon, tnielsen, vkumar
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	vault 1.12.0, vault 1.11.4, vault 1.10.7, vault 1.9.10	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in HashiCorp Vault and Vault Enterprise. Vault’s TLS certificate auth method did not initially load the optionally-configured CRL issued by the role’s Certificate Authority (CA) into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-01-21 08:22:11 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2135600, 2135601, 2135602, 2135603, 2135604, 2135605, 2135606
Bug Blocks:	2134738

Description Avinash Hanwate 2022-10-17 10:21:37 UTC

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.

https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first-request/45483
https://discuss.hashicorp.com

Comment 14 errata-xmlrpc 2023-01-17 19:37:40 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.12

Via RHSA-2022:7399 https://access.redhat.com/errata/RHSA-2022:7399

Comment 15 Product Security DevOps Team 2023-01-21 08:22:08 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-41316

Comment 16 errata-xmlrpc 2023-05-17 22:31:05 UTC

This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2023:1326 https://access.redhat.com/errata/RHSA-2023:1326

Comment 17 errata-xmlrpc 2023-06-22 19:52:02 UTC

This issue has been addressed in the following products:

  RHODF-4.13-RHEL-9

Via RHSA-2023:3742 https://access.redhat.com/errata/RHSA-2023:3742