—
GO-2022-0578
Incorrect Privilege Assignment in HashiCorp Vault in github.com/hashicorp/vault
Quick fix
GO-2022-0578 — github.com/hashicorp/vault: upgrade to the fixed version with the command below.
go get github.com/hashicorp/vault@v1.8.5Details
Incorrect Privilege Assignment in HashiCorp Vault in github.com/hashicorp/vault
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/hashicorp/vault
Introduced in:
1.8.0Fixed in: 1.8.5Fix
go get github.com/hashicorp/vault@v1.8.5References
- https://github.com/advisories/GHSA-362v-wg5p-64w2[ADVISORY]
- https://nvd.nist.gov/vuln/detail/CVE-2021-42135[ADVISORY]
- https://discuss.hashicorp.com/t/hcsec-2021-28-vaults-google-cloud-secrets-engine-policies-with-globs-may-provide-additional-privileges-in-vault-1-8-0-onwards[WEB]
- https://github.com/hashicorp/vault/blob/main/CHANGELOG.md#180[WEB]