CVE-2023-0620 (https://discuss.hashicorp.com/t/hcsec-2023-12-vault-s-microsoft-sql-database-storage-backend-vulnerable-to-sql-injection-via-configuration-file/52080/1): HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not sanitized when passed to the user-provided MSSQL database. An attacker may modify these parameters to execute a malicious SQL command. This issue is fixed in versions 1.13.1, 1.12.5, and 1.11.9. CVE-2023-0665 (https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1): HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9. CVE-2023-25000 (https://discuss.hashicorp.com/t/hcsec-2023-10-vault-vulnerable-to-cache-timing-attacks-during-seal-and-unseal-operations/52078): HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9. Please bump to 1.11.0 and 1.12.5.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=36e59bfe01ebf40d9b0af0cc0e0c80a3223cae39 commit 36e59bfe01ebf40d9b0af0cc0e0c80a3223cae39 Author: Zac Medico <zmedico@gentoo.org> AuthorDate: 2023-04-06 04:17:43 +0000 Commit: Zac Medico <zmedico@gentoo.org> CommitDate: 2023-04-06 04:23:00 +0000 app-admin/vault: add 1.12.5 Bug: https://bugs.gentoo.org/903806 Signed-off-by: Zac Medico <zmedico@gentoo.org> app-admin/vault/Manifest | 2 + app-admin/vault/vault-1.12.5.ebuild | 86 +++++++++++++++++++++++++++++++++++++ 2 files changed, 88 insertions(+) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=e3b9acded02e1aebce501a5537010e991670dc0b commit e3b9acded02e1aebce501a5537010e991670dc0b Author: Zac Medico <zmedico@gentoo.org> AuthorDate: 2023-04-06 03:58:30 +0000 Commit: Zac Medico <zmedico@gentoo.org> CommitDate: 2023-04-06 04:22:59 +0000 app-admin/vault: add 1.11.9 Bug: https://bugs.gentoo.org/903806 Signed-off-by: Zac Medico <zmedico@gentoo.org> app-admin/vault/Manifest | 2 + app-admin/vault/vault-1.11.9.ebuild | 86 +++++++++++++++++++++++++++++++++++++ 2 files changed, 88 insertions(+)
CVE-2023-24999 (https://discuss.hashicorp.com/t/hcsec-2023-07-vault-fails-to-verify-if-approle-secretid-belongs-to-role-during-a-destroy-operation/51305): HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.
