Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-rr8j-7w34-xp5j #3191

Closed
GoVulnBot opened this issue Oct 10, 2024 · 1 comment
Closed

x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-rr8j-7w34-xp5j #3191

GoVulnBot opened this issue Oct 10, 2024 · 1 comment
Assignees
@maceonthompson

Comments

@GoVulnBot
Copy link

Advisory GHSA-rr8j-7w34-xp5j references a vulnerability in the following Go modules:

Module
github.com/hashicorp/vault

Description:
A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16.

References:

Cross references:

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/hashicorp/vault
      versions:
        - fixed: 1.18.0
      vulnerable_at: 1.18.0-rc1
summary: Vault Community Edition privilege escalation vulnerability in github.com/hashicorp/vault
cves:
    - CVE-2024-9180
ghsas:
    - GHSA-rr8j-7w34-xp5j
references:
    - advisory: https://github.com/advisories/GHSA-rr8j-7w34-xp5j
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-9180
    - web: https://discuss.hashicorp.com/t/hcsec-2024-21-vault-operators-in-root-namespace-may-elevate-their-privileges/70565
source:
    id: GHSA-rr8j-7w34-xp5j
    created: 2024-10-10T23:01:19.109776918Z
review_status: UNREVIEWED
@maceonthompson maceonthompson self-assigned this Oct 11, 2024
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/619696 mentions this issue: data/reports: add 6 reports

@GoVulnBot GoVulnBot mentioned this issue Oct 31, 2024
Closed
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees

@maceonthompson maceonthompson

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@gopherbot @maceonthompson @GoVulnBot