Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating Rolesets

CVE-2023-5077
7.5HIGH

Key Information

Vendor
Hashicorp
Status
Vault
Vault Enterprise
Vendor
CVE Published:
29 September 2023

Summary

The Vault and Vault Enterprise ("Vault") Google Cloud secrets engine did not preserve existing Google Cloud IAM Conditions upon creating or updating rolesets. Fixed in Vault 1.13.0.

Affected Version(s)

Vault < 1.13.0

Vault Enterprise < 1.13.0

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Risk change from: 7.5 to: 7.6 - (HIGH)

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database
.