Security controls bypass or absence In github.com/hashicorp/vault
Description
HashiCorp Vault and Vault Enterprise's AWS Auth method may be susceptible to authentication bypass Vault and Vault Enterprise's ("Vault") AWS Auth method may be susceptible to authentication bypass if the role of the configured bound_principal_iam is the same across AWS accounts, or uses a wildcard. This vulnerability is fixed in Vault Community Edition 1.21.0 and Vault Enterprise 1.21.0, 1.20.5, 1.19.11, and 1.16.27.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 go | 1.21.0 |
Aliases
1. 2. 3. 4.
References
1. 2.