TLS Certificate Authentication Method Issue in HashiCorp Vault and Vault Enterprise

CVE-2022-41316

Summary

The TLS certificate authentication method in HashiCorp Vault and Vault Enterprise presented an issue where an optionally configured Certificate Revocation List (CRL) from the role's Certificate Authority (CA) was not loaded into memory at startup. This oversight left the revocation status of certificates unchecked until the CRL was retrieved for the first request, potentially allowing access from revoked certificates. The vulnerability was addressed in the releases 1.12.0, 1.11.4, 1.10.7, and 1.9.10, which now ensure that the CRL is properly loaded at application startup, enhancing overall security and compliance.

References