Bug 2189538 (CVE-2020-10660)

Summary:	CVE-2020-10660 vault: Entity's Group membership inadvertently include Groups the Entity no longer has permissions to
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	amctagga, muagarwa, nbecker, tnielsen, ypadia
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	vault 1.3.4	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in HashiCorp Vault and Vault Enterprise. This flaw allows a remote attacker to bypass security restrictions caused by an issue when inadvertently including Groups the Entity no longer has permission to. By sending a specially crafted request, an attacker can bypass access restrictions.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-08-03 13:39:13 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2223663

Description Pedro Sampaio 2023-04-25 14:19:16 UTC

HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.

References:

https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#134-march-19th-2020
https://www.hashicorp.com/blog/category/vault/

Comment 4 Product Security DevOps Team 2023-08-03 13:39:11 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-10660