Improper authorization control for web services In github.com/hashicorp/vault
Description
Improper Authentication in HashiCorp Vault
HashiCorp Vault Enterprise 1.6.0 & 1.6.1 allowed the remove-peer raft operator command to be executed against DR secondaries without authentication. Fixed in 1.6.2.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 go | 1.6.2 |
Aliases
1. 2. 3. 4. 5.
References
1. 2.