CVE-2023-6337: HashiCorp Vault and Vault Enterprise 1.12.0 and newer are vulnerable to a denial of service through memory exhaustion of the host when handling large unauthenticated and authenticated HTTP requests from a client. Vault will attempt to map the request to memory, resulting in the exhaustion of available memory on the host, which may cause Vault to crash. Fixed in Vault 1.15.4, 1.14.8, 1.13.12. Please bump (and ideally stabilize for bug 9184120 too).
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f1ee3a0737d807e5704a5f5455118bfe48af1f87 commit f1ee3a0737d807e5704a5f5455118bfe48af1f87 Author: Zac Medico <zmedico@gentoo.org> AuthorDate: 2023-12-18 04:45:10 +0000 Commit: Zac Medico <zmedico@gentoo.org> CommitDate: 2023-12-18 04:46:14 +0000 app-admin/vault: add 1.14.8 Bug: https://bugs.gentoo.org/920177 Signed-off-by: Zac Medico <zmedico@gentoo.org> app-admin/vault/Manifest | 2 + app-admin/vault/vault-1.14.8.ebuild | 86 +++++++++++++++++++++++++++++++++++++ 2 files changed, 88 insertions(+)
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=8d5daa8cf3fc0b03de4f7cabb5b622d5ce445572 commit 8d5daa8cf3fc0b03de4f7cabb5b622d5ce445572 Author: Zac Medico <zmedico@gentoo.org> AuthorDate: 2024-10-11 21:29:35 +0000 Commit: Zac Medico <zmedico@gentoo.org> CommitDate: 2024-10-11 21:31:39 +0000 app-admin/vault: drop 1.14.5, 1.16.1 Bug: https://bugs.gentoo.org/920177 Signed-off-by: Zac Medico <zmedico@gentoo.org> app-admin/vault/Manifest | 5 --- app-admin/vault/vault-1.14.5.ebuild | 86 ------------------------------------ app-admin/vault/vault-1.16.1.ebuild | 87 ------------------------------------- 3 files changed, 178 deletions(-)
