CVE-2021-41802 (Low) detected in vaultv0.10.0

[mend-bolt-for-github[bot]]

CVE-2021-41802 - Low Severity Vulnerability

Vulnerable Library - vaultv0.10.0

A tool for secrets management, encryption as a service, and privileged access management

Library home page: https://github.com/hashicorp/vault.git

Found in HEAD commit: 9060713df80212ee5546b36d1083fb607520eb0b

Found in base branch: master

Vulnerable Source Files (1)

/vendor/github.com/hashicorp/vault/vault/identity_store_aliases.go

Vulnerability Details

HashiCorp Vault and Vault Enterprise through 1.7.4 and 1.8.3 allowed a user with write permission to an entity alias ID sharing a mount accessor with another user to acquire this other user’s policies by merging their identities. Fixed in Vault and Vault Enterprise 1.7.5 and 1.8.4.

Publish Date: 2021-10-08

URL: CVE-2021-41802

CVSS 3 Score Details (2.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Adjacent - Attack Complexity: Low - Privileges Required: High - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://discuss.hashicorp.com/t/hcsec-2021-27-vault-merging-multiple-entity-aliases-for-the-same-mount-may-allow-privilege-escalation/30420

Release Date: 2021-10-08

Fix Resolution: v1.7.5,v1.8.3

---

Step up your Open Source Security Game with Mend here

[mend-bolt-for-github[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.

[mend-bolt-for-github[bot]]

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.