Most recent entries from all

bdu:2024-06028

BIT-vault-2023-5077 — Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets

Affected: Bitnami: vault

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

EUVD-2026-189452

fkie_cve-2023-5077

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

GHSA-86c6-3g63-5w64 — Hashicorp Vault Incorrect Permission Assignment for Critical Resource vulnerability

Affected: Go: github.com/hashicorp/vault

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

gsd-2023-5077

RHSA-2023:6832 — Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.14.0 security, enhancement & bug fix update

lapack: Out-of-bounds read in *larrv golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding hashicorp: html injection into web ui Hashicorp/vault: Vault’s LDAP Auth Method Allows for User Enumeration golang.org/x/net/html: Cross site scripting hashicorp/vault: Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets golang: net/http, net/textproto: denial of service from excessive memory allocation golang: html/template: improper sanitization of CSS values golang: html/template: improper handling of empty HTML attributes goproxy: Denial of service (DoS) via unspecified vectors. golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)

WID-SEC-W-2023-2513 — Hashicorp Vault: Mehrere Schwachstellen

Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in Hashicorp Vault ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen oder Sicherheitsmaßnahmen zu umgehen.