Filtered by vendor Hashicorp
Subscriptions
Total
144 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-7955 | 1 Hashicorp | 1 Consul | 2021-07-21 | 5.3 Medium |
| HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended information disclosure. Fixed in 1.6.3. | ||||
| CVE-2020-7220 | 1 Hashicorp | 1 Vault | 2021-07-21 | 7.5 High |
| HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2. | ||||
| CVE-2020-7219 | 1 Hashicorp | 1 Consul | 2021-07-21 | 7.5 High |
| HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service. Fixed in 1.6.3. | ||||
| CVE-2020-35177 | 1 Hashicorp | 1 Vault | 2021-07-21 | 5.3 Medium |
| HashiCorp Vault and Vault Enterprise 1.4.1 and newer allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1. | ||||
| CVE-2020-15511 | 1 Hashicorp | 1 Terraform Enterprise | 2021-07-21 | 5.3 Medium |
| HashiCorp Terraform Enterprise up to v202006-1 contained a default signup page that allowed user registration even when disabled, bypassing SAML enforcement. Fixed in v202007-1. | ||||
| CVE-2020-13250 | 1 Hashicorp | 1 Consul | 2021-07-21 | 7.5 High |
| HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of service. Fixed in 1.6.6 and 1.7.4. | ||||
| CVE-2020-12797 | 1 Hashicorp | 1 Consul | 2021-07-21 | 5.3 Medium |
| HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4.0, fixed in 1.6.6 and 1.7.4. | ||||
| CVE-2019-19316 | 1 Hashicorp | 1 Terraform | 2021-07-21 | 7.5 High |
| When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP. | ||||
| CVE-2021-32575 | 1 Hashicorp | 1 Nomad | 2021-06-22 | 6.5 Medium |
| HashiCorp Nomad and Nomad Enterprise up to version 1.0.4 bridge networking mode allows ARP spoofing from other bridged tasks on the same node. Fixed in 0.12.12, 1.0.5, and 1.1.0 RC1. | ||||
| CVE-2021-32074 | 1 Hashicorp | 1 Vault-action | 2021-05-14 | 7.5 High |
| HashiCorp vault-action (aka Vault GitHub Action) before 2.2.0 allows attackers to obtain sensitive information from log files because a multi-line secret was not correctly registered with GitHub Actions for log masking. | ||||
| CVE-2021-29653 | 1 Hashicorp | 1 Vault | 2021-04-29 | 7.5 High |
| HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL. Fixed in 1.5.8, 1.6.4, and 1.7.1. | ||||
| CVE-2021-30476 | 1 Hashicorp | 1 Terraform Provider | 2021-04-29 | 9.8 Critical |
| HashiCorp Terraform’s Vault Provider (terraform-provider-vault) did not correctly configure GCE-type bound labels for Vault’s GCP auth method. Fixed in 2.19.1. | ||||
| CVE-2021-27400 | 1 Hashicorp | 1 Vault | 2021-04-27 | 7.5 High |
| HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) did not validate TLS certificates when connecting to Cassandra clusters. Fixed in 1.6.4 and 1.7.1 | ||||
| CVE-2020-29529 | 1 Hashicorp | 1 Go-slug | 2021-03-08 | 7.5 High |
| HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0. | ||||
| CVE-2021-3283 | 1 Hashicorp | 1 Nomad | 2021-02-04 | 7.5 High |
| HashiCorp Nomad and Nomad Enterprise up to 0.12.9 exec and java task drivers can access processes associated with other tasks on the same node. Fixed in 0.12.10, and 1.0.3. | ||||
| CVE-2020-29564 | 1 Hashicorp | 1 Consul Docker Image | 2020-12-22 | 9.8 Critical |
| The official Consul Docker images 0.7.1 through 1.4.2 contain a blank password for a root user. System using the Consul Docker container deployed by affected versions of the Docker image may allow a remote attacker to achieve root access with a blank password. | ||||
| CVE-2020-35192 | 1 Hashicorp | 1 Vault | 2020-12-18 | 9.8 Critical |
| The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password. | ||||
| CVE-2020-28348 | 1 Hashicorp | 1 Nomad | 2020-12-04 | 6.5 Medium |
| HashiCorp Nomad and Nomad Enterprise 0.9.0 up to 0.12.7 client Docker file sandbox feature may be subverted when not explicitly disabled or when using a volume mount type. Fixed in 0.12.8, 0.11.7, and 0.10.8. | ||||
| CVE-2020-27195 | 1 Hashicorp | 1 Nomad | 2020-11-02 | 9.1 Critical |
| HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6 | ||||
| CVE-2020-12757 | 1 Hashicorp | 1 Vault | 2020-10-12 | 9.8 Critical |
| HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2. | ||||