Bug 2167397 (CVE-2020-13223) - CVE-2020-13223 vault: Information disclosure from logged proxy environment variables
Summary: CVE-2020-13223 vault: Information disclosure from logged proxy environment va...
Keywords:
Status: NEW
Alias: CVE-2020-13223
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 2167760
Blocks: 2167459
TreeView+ depends on / blocked
 
Reported: 2023-02-06 14:18 UTC by Pedro Sampaio
Modified: 2023-08-03 08:28 UTC (History)
12 users (show)

Fixed In Version: vault 1.3.6, vault 1.4.2
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the HashiCorp Vault. The HashiCorp Vault and Vault Enterprise could allow a remote attacker to obtain sensitive information caused by inserting sensitive information into a log file. By accessing the log file, a remote attacker can obtain sensitive information.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Pedro Sampaio 2023-02-06 14:18:43 UTC 
HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2.

References:

https://www.hashicorp.com/blog/category/vault/
https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#142-may-21st-2020
Note You need to log in before you can comment on or make changes to this bug.