TLS Certificate Authentication Method Issue in HashiCorp Vault and Vault Enterprise
CVE-2022-41316

5.3MEDIUM

Key Information:

Vendor

Hashicorp
Status
Vault
Vendor
CVE Published:
12 October 2022

What is CVE-2022-41316?

The TLS certificate authentication method in HashiCorp Vault and Vault Enterprise presented an issue where an optionally configured Certificate Revocation List (CRL) from the role's Certificate Authority (CA) was not loaded into memory at startup. This oversight left the revocation status of certificates unchecked until the CRL was retrieved for the first request, potentially allowing access from revoked certificates. The vulnerability was addressed in the releases 1.12.0, 1.11.4, 1.10.7, and 1.9.10, which now ensure that the CRL is properly loaded at application startup, enhancing overall security and compliance.

References

https://discuss.hashicorp.com
https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-...
https://security.netapp.com/advisory/ntap-20221201-0001/

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.