CVE-2021-32923

HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.

Published: Jun 3, 2021
Updated: May 9, 2024
CVE: CVE-2021-32923
GHSA: GHSA-38j9-7pp9-2hjw
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 7.4
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v2:

Severity: Medium
Score: 5.8
AV:N/AC:M/Au:N/C:P/I:P/A:N

CWEs:

CWE-613

OWASP TOP 10:

A2 - Broken Authentication

Affected Software
References

Software	From	Fixed in
hashicorp / vault	1.7.0	1.7.2
hashicorp / vault	1.6.0	1.6.5
hashicorp / vault	0.10.0	1.5.9
github.com/hashicorp/vault	1.7.0	1.7.2
github.com/hashicorp/vault	1.6.0	1.6.5
github.com/hashicorp/vault	0.10.0	1.5.9

https://discuss.hashicorp.com/t/hcsec-2021-15-vault-renewed-nearly-expired-leases-with-incorrect-non-expiring-ttls/24603
https://security.gentoo.org/glsa/202207-01
https://www.hashicorp.com/blog/category/vault/

Vulnerability Database

CVE-2021-32923