Bug 835070 (CVE-2022-25243)

Summary:	<app-admin/vault-1.9.4: improper wildcard certificate issuance
Product:	Gentoo Security	Reporter:	John Helmert III <ajak>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	minor	CC:	zmedico
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
URL:	https://discuss.hashicorp.com/t/hcsec-2022-09-vault-pki-secrets-engine-policy-results-in-incorrect-wildcard-certificate-issuance/36600
Whiteboard:	B4 [glsa+]
Package list:		Runtime testing required:	---

Description John Helmert III archtester

2022-03-13 13:38:13 UTC

CVE-2022-25243:

"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allow_subdomains is set to false. Fixed in Vault Enterprise 1.8.9 and 1.9.4.

Please stabilize 1.9.4.

Comment 1 Larry the Git Cow gentoo-dev

2022-03-13 15:50:22 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e16f81b94cb995e87e91ca2bd654861d3d993d93

commit e16f81b94cb995e87e91ca2bd654861d3d993d93
Author:     Zac Medico <zmedico@gentoo.org>
AuthorDate: 2022-03-13 15:49:10 +0000
Commit:     Zac Medico <zmedico@gentoo.org>
CommitDate: 2022-03-13 15:50:17 +0000

    app-admin/vault: remove vulnerable versions
    
    Bug: https://bugs.gentoo.org/835070
    Signed-off-by: Zac Medico <zmedico@gentoo.org>

 app-admin/vault/Manifest           |  4 --
 app-admin/vault/vault-1.9.2.ebuild | 85 --------------------------------------
 app-admin/vault/vault-1.9.3.ebuild | 85 --------------------------------------
 3 files changed, 174 deletions(-)

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7a751c9ce7dcb97b8e758b520ebe2dcb37c942ea

commit 7a751c9ce7dcb97b8e758b520ebe2dcb37c942ea
Author:     Zac Medico <zmedico@gentoo.org>
AuthorDate: 2022-03-13 15:48:24 +0000
Commit:     Zac Medico <zmedico@gentoo.org>
CommitDate: 2022-03-13 15:50:16 +0000

    app-admin/vault: stabilize 1.9.4 for amd64
    
    Bug: https://bugs.gentoo.org/835070
    Signed-off-by: Zac Medico <zmedico@gentoo.org>

 app-admin/vault/vault-1.9.4.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comment 2 John Helmert III archtester

2022-03-13 17:12:55 UTC

Thanks!

Comment 3 Larry the Git Cow gentoo-dev

2022-08-01 18:07:25 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=254c716d0dd35a6846f281fd4a3eaf970dc0bede

commit 254c716d0dd35a6846f281fd4a3eaf970dc0bede
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2022-07-29 21:22:59 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2022-08-01 18:05:08 +0000

    [ GLSA-202207-01 ] HashiCorp Vault: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/768312
    Bug: https://bugs.gentoo.org/797244
    Bug: https://bugs.gentoo.org/808093
    Bug: https://bugs.gentoo.org/817269
    Bug: https://bugs.gentoo.org/827945
    Bug: https://bugs.gentoo.org/829493
    Bug: https://bugs.gentoo.org/835070
    Bug: https://bugs.gentoo.org/845405
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202207-01.xml | 61 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)

Comment 4 John Helmert III archtester

2022-08-01 18:09:03 UTC

GLSA released, all done!