Most recent entries from all

bdu:2025-06177

BIT-vault-2023-24999 — Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation

Affected: Bitnami: vault

HashiCorp Vault and Vault Enterprise’s approle auth method allowed any authenticated user with access to an approle destroy endpoint to destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability is fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.

EUVD-2026-220324

fkie_cve-2023-24999

GHSA-wmg5-g953-qqfw — Hashicorp Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation

Affected: Go: github.com/hashicorp/vault

When using the Vault and Vault Enterprise (Vault) approle auth method, any authenticated user with access to the `/auth/approle/role/:role_name/secret-id-accessor/destroy` endpoint can destroy the secret ID of any other role by providing the secret ID accessor. This vulnerability, CVE-2023-24999, has been fixed in Vault 1.13.0, 1.12.4, 1.11.8, 1.10.11 and above.

gsd-2023-24999

RHSA-2023:3742 — Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.13.0 security and bug fix update

vault: Hashicorp Vault AWS IAM Integration Authentication Bypass vault: GCP Auth Method Allows Authentication Bypass validator: Inefficient Regular Expression Complexity in Validator.js nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes go-yaml: Denial of Service in go-yaml goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be vault: incorrect policy enforcement nodejs: Improper handling of URI Subject Alternative Names nodejs: Certificate Verification Bypass via String Injection nodejs: Incorrect handling of certificate subject and issuer fields golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters nodejs-minimatch: ReDoS via the braceExpand function nodejs: Prototype pollution via console.table properties jsonwebtoken: Insecure default algorithm in jwt.verify() could lead to signature validation bypass jsonwebtoken: Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC golang: net/http: handle server errors after sending GOAWAY golang: encoding/gob: stack exhaustion in Decoder.Decode golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service golang: net/url: JoinPath does not strip relative path components in all circumstan…

WID-SEC-W-2023-0627 — Hashicorp Vault: Schwachstelle ermöglicht Denial of Service

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Hashicorp Vault ausnutzen, um einen Denial of Service Angriff durchzuführen.