BIT-vault-2024-7594

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/vault/BIT-vault-2024-7594.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-vault-2024-7594
Aliases
Published
2024-09-30T09:10:31.036Z
Modified
2024-09-30T09:57:49.997759Z
Summary
[none]
Details

Vault’s SSH secrets engine did not require the validprincipals list to contain a value by default. If the validprincipals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.

References

Affected packages

Bitnami / vault

Package

Name
vault
Purl
pkg:bitnami/vault

Severity

  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
1.7.7
Fixed
1.17.6