Vulnerabilities (CVE)

Filtered by vendor Hashicorp Subscribe
Total 150 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2021-32575 1 Hashicorp 1 Nomad 2024-02-28 3.3 LOW 6.5 MEDIUM
HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1.
CVE-2021-30476 1 Hashicorp 1 Terraform Provider 2024-02-28 7.5 HIGH 9.8 CRITICAL
HashiCorp Terraform’s Vault Provider (terraform-provider-vault) did not correctly configure GCE-type bound labels for Vault’s GCP auth method. Fixed in 2.19.1.
CVE-2021-38698 1 Hashicorp 1 Consul 2024-02-28 4.0 MEDIUM 6.5 MEDIUM
HashiCorp Consul and Consul Enterprise 1.10.1 Txn.Apply endpoint allowed services to register proxies for other services, enabling access to service traffic. Fixed in 1.8.15, 1.9.9 and 1.10.2.
CVE-2020-25864 1 Hashicorp 1 Consul 2024-02-28 4.3 MEDIUM 6.1 MEDIUM
HashiCorp Consul and Consul Enterprise up to version 1.9.4 key-value (KV) raw mode was vulnerable to cross-site scripting. Fixed in 1.9.5, 1.8.10 and 1.7.14.
CVE-2021-29653 1 Hashicorp 1 Vault 2024-02-28 4.3 MEDIUM 7.5 HIGH
HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL. Fixed in 1.5.8, 1.6.4, and 1.7.1.
CVE-2021-37219 1 Hashicorp 1 Consul 2024-02-28 6.5 MEDIUM 8.8 HIGH
HashiCorp Consul and Consul Enterprise 1.10.1 Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.8.15, 1.9.9 and 1.10.2.
CVE-2021-27668 1 Hashicorp 1 Vault 2024-02-28 5.0 MEDIUM 5.3 MEDIUM
HashiCorp Vault Enterprise 0.9.2 through 1.6.2 allowed the read of license metadata from DR secondaries without authentication. Fixed in 1.6.3.
CVE-2021-32574 1 Hashicorp 1 Consul 2024-02-28 5.0 MEDIUM 7.5 HIGH
HashiCorp Consul and Consul Enterprise 1.3.0 through 1.10.0 Envoy proxy TLS configuration does not validate destination service identity in the encoded subject alternative name. Fixed in 1.8.14, 1.9.8, and 1.10.1.
CVE-2021-28156 1 Hashicorp 1 Consul 2024-02-28 5.0 MEDIUM 7.5 HIGH
HashiCorp Consul Enterprise version 1.8.0 up to 1.9.4 audit log can be bypassed by specifically crafted HTTP events. Fixed in 1.9.5, and 1.8.10.
CVE-2021-32923 1 Hashicorp 1 Vault 2024-02-28 5.8 MEDIUM 7.4 HIGH
HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.
CVE-2021-37218 1 Hashicorp 1 Nomad 2024-02-28 6.5 MEDIUM 8.8 HIGH
HashiCorp Nomad and Nomad Enterprise Raft RPC layer allows non-server agents with a valid certificate signed by the same CA to access server-only functionality, enabling privilege escalation. Fixed in 1.0.10 and 1.1.4.
CVE-2021-27400 1 Hashicorp 1 Vault 2024-02-28 5.0 MEDIUM 7.5 HIGH
HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1
CVE-2021-32074 1 Hashicorp 1 Vault-action 2024-02-28 5.0 MEDIUM 7.5 HIGH
HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking.
CVE-2021-36213 1 Hashicorp 1 Consul 2024-02-28 5.0 MEDIUM 7.5 HIGH
HashiCorp Consul and Consul Enterprise 1.9.0 through 1.10.0 default deny policy with a single L7 application-aware intention deny action cancels out, causing the intention to incorrectly fail open, allowing L4 traffic. Fixed in 1.9.8 and 1.10.1.
CVE-2021-36230 1 Hashicorp 1 Terraform 2024-02-28 6.5 MEDIUM 8.8 HIGH
HashiCorp Terraform Enterprise releases up to v202106-1 did not properly perform authorization checks on a subset of API requests executed using the run token, allowing privilege escalation to organization owner. Fixed in v202107-1.
CVE-2021-38553 1 Hashicorp 1 Vault 2024-02-28 2.1 LOW 4.4 MEDIUM
HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.
CVE-2021-38554 1 Hashicorp 1 Vault 2024-02-28 3.5 LOW 5.3 MEDIUM
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.
CVE-2020-28348 1 Hashicorp 1 Nomad 2024-02-28 6.3 MEDIUM 6.5 MEDIUM
HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8.
CVE-2020-28053 1 Hashicorp 1 Consul 2024-02-28 4.0 MEDIUM 6.5 MEDIUM
HashiCorp Consul and Consul Enterprise 1.2.0 up to 1.8.5 allowed operators with operator:read ACL permissions to read the Connect CA private key configuration. Fixed in 1.6.10, 1.7.10, and 1.8.6.
CVE-2020-35177 1 Hashicorp 1 Vault 2024-02-28 5.0 MEDIUM 5.3 MEDIUM
HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1.