Bug 2228020 (CVE-2023-3462)
| Summary: | CVE-2023-3462 Hashicorp/vault: Vault’s LDAP Auth Method Allows for User Enumeration | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Borja Tarraso <btarraso> |
| Component: | vulnerability | Assignee: | Nobody <nobody> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | amctagga, dfreiber, drow, jburrell, jcantril, manissin, mrajanna, muagarwa, nbecker, nobody, rogbas, rojacob, tnielsen, vkumar |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | vault 1.14.1, vault 1.13.5 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A flaw was found in the HashiCorp Vault. The Vault and Vault Enterprise (“Vault”) LDAP auth method allows unauthenticated users to potentially enumerate valid accounts in the configured LDAP system by observing the response error when querying usernames.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2228023, 2228024, 2228025, 2228026 | ||
| Bug Blocks: | 2228018 | ||
|
Description
Borja Tarraso
2023-08-01 07:16:41 UTC
This issue has been addressed in the following products: RHODF-4.14-RHEL-9 Via RHSA-2023:6832 https://access.redhat.com/errata/RHSA-2023:6832 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.16 Via RHSA-2024:7599 https://access.redhat.com/errata/RHSA-2024:7599 This issue has been addressed in the following products: Red Hat OpenShift Container Platform 4.17 Via RHSA-2024:7922 https://access.redhat.com/errata/RHSA-2024:7922 |