GHSA-jg74-mwgw-v6x3

Suggest an improvement
Source
https://github.com/advisories/GHSA-jg74-mwgw-v6x3
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-jg74-mwgw-v6x3/GHSA-jg74-mwgw-v6x3.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-jg74-mwgw-v6x3
Aliases
Published
2024-09-26T21:31:11Z
Modified
2024-09-30T09:57:49.997759Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default
Details

Vault’s SSH secrets engine did not require the validprincipals list to contain a value by default. If the validprincipals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.

References

Affected packages

Go / github.com/hashicorp/vault

Package

Name
github.com/hashicorp/vault
View open source insights on deps.dev
Purl
pkg:golang/github.com/hashicorp/vault

Affected ranges

Type
SEMVER
Events
Introduced
1.7.7
Fixed
1.17.6