Improper Authorization Affecting github.com/hashicorp/vault/vault package, versions >=1.11.0 <1.11.9 >=1.12.5 <1.12.5 >=1.13.0 <1.13.1
Threat Intelligence
EPSS
0.09% (40th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMHASHICORPVAULTVAULT-5351869
- published 31 Mar 2023
- disclosed 30 Mar 2023
- credit Vault Engineering Team
Introduced: 30 Mar 2023
CVE-2023-0665 Open this link in a new tabHow to fix?
Upgrade github.com/hashicorp/vault/vault to version 1.11.9, 1.13.1 or higher.
Overview
github.com/hashicorp/vault/vault is a tool for securely accessing secrets.
Affected versions of this package are vulnerable to Improper Authorization such that HashiCorp Vault's PKI mount issuer endpoints do not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount.
Note: This bug does not affect public or private key material, trust chains or certificate issuance.
CVSS Scores
version 3.1