Affected: Bitnami: vault

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.

Affected: Go: github.com/hashicorp/vault

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.

golang: out-of-bounds read in golang.org/x/text/language leads to DoS golang: net/http: improper sanitization of Transfer-Encoding header golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters prometheus/client_golang: Denial of service using InstrumentHandlerCounter golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working golang: net/url: JoinPath does not strip relative path components in all circumstances vault: insufficient certificate revocation list checking golang: regexp/syntax: limit memory used by parsing regexps openshift: etcd grpc-proxy vulnerable to The Birthday attack against 64-bit block cipher

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial of Service Zustand herbeizuführen, Informationen offenzulegen, Dateien zu manipulieren oder Sicherheitsvorkehrungen zu umgehen.