Hashicorp
Page 3 of 3 — Hashicorp CVEs from a corpus of 233, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-13250 | High | 7.5 | 2020-06-11 | HashiCorp Consul and Consul Enterprise include an HTTP API (introduced in 1.2.0) and DNS (introduced in 1.4.3) caching feature that was vulnerable to denial of… |
CVE-2020-13170 | High | 7.5 | 2020-06-11 | HashiCorp Consul and Consul Enterprise did not appropriately enforce scope for local tokens issued by a primary data center, where replication to a secondary d… |
CVE-2020-12797 | Medium | 5.3 | 2020-06-11 | HashiCorp Consul and Consul Enterprise failed to enforce changes to legacy ACL token rules due to non-propagation to secondary data centers. Introduced in 1.4… |
CVE-2020-12758 | High | 7.5 | 2020-06-11 | HashiCorp Consul and Consul Enterprise could crash when configured with an abnormally-formed service-router entry. Introduced in 1.6.0, fixed in 1.6.6 and 1.7… |
CVE-2020-13223 | High | 7.5 | 2020-06-10 | HashiCorp Vault and Vault Enterprise logged proxy environment variables that potentially included sensitive credentials. Fixed in 1.3.6 and 1.4.2. |
CVE-2020-12757 | Critical | 9.8 | 2020-06-10 | HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default ti… |
CVE-2020-10944 | Medium | 5.4 | 2020-04-28 | HashiCorp Nomad and Nomad Enterprise up to 0.10.4 contained a cross-site scripting vulnerability such that files from a malicious workload could cause arbitrar… |
CVE-2020-10661 | Critical | 9.1 | 2020-03-23 | HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespa… |
CVE-2020-10660 | Medium | 5.3 | 2020-03-23 | HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Gro… |
CVE-2019-19879 | High | 7.5 | 2020-02-14 | HashiCorp Sentinel up to 0.10.1 incorrectly parsed negation in certain policy expressions. Fixed in 0.10.2. |
CVE-2020-7956 | Critical | 9.8 | 2020-01-31 | HashiCorp Nomad and Nomad Enterprise up to 0.10.2 incorrectly validated role/region associated with TLS certificates used for mTLS RPC, and were susceptible to… |
CVE-2020-7955 | Medium | 5.3 | 2020-01-31 | HashiCorp Consul and Consul Enterprise 1.4.1 through 1.6.2 did not uniformly enforce ACLs across all API endpoints, resulting in potential unintended informati… |
CVE-2020-7219 | High | 7.5 | 2020-01-31 | HashiCorp Consul and Consul Enterprise up to 1.6.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of servic… |
CVE-2020-7218 | High | 7.5 | 2020-01-31 | HashiCorp Nomad and Nonad Enterprise up to 0.10.2 HTTP/RPC services allowed unbounded resource usage, and were susceptible to unauthenticated denial of service… |
CVE-2020-7220 | High | 7.5 | 2020-01-23 | HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2. |
CVE-2019-19316 | High | 7.5 | 2019-12-02 | When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartex… |
CVE-2019-12618 | Critical | 9.8 | 2019-08-12 | HashiCorp Nomad 0.9.0 through 0.9.1 has Incorrect Access Control via the exec driver. |
CVE-2019-12291 | High | 7.5 | 2019-06-06 | HashiCorp Consul 1.4.0 through 1.5.0 has Incorrect Access Control. Keys not matching a specific ACL rule used for prefix matching in a policy can be deleted by… |
CVE-2019-9764 | High | 7.4 | 2019-03-26 | HashiCorp Consul 1.4.3 lacks server hostname verification for agent-to-agent TLS communication. In other words, the product behaves as if verify_server_hostnam… |
CVE-2019-8336 | High | 8.1 | 2019-03-05 | HashiCorp Consul (and Consul Enterprise) 1.4.x before 1.4.3 allows a client to bypass intended access restrictions and obtain the privileges of one other arbit… |
CVE-2018-19653 | Medium | 5.9 | 2018-12-09 | HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the… |
CVE-2018-19786 | High | 8.1 | 2018-12-05 | HashiCorp Vault before 1.0.0 writes the master key to the server log in certain unusual or misconfigured scenarios in which incorrect data comes from the autos… |
CVE-2018-15869 | Medium | 5.3 | 2018-08-25 | An Amazon Web Services (AWS) developer who does not specify the --owners flag when describing images via AWS CLI, and therefore not properly validating source… |
CVE-2017-16873 | High | 7.8 | 2018-03-29 | It is possible to exploit an unsanitized PATH in the suid binary that ships with vagrant-vmware-fusion 4.0.25 through 5.0.4 in order to escalate to root privil… |
CVE-2017-16839 | High | 7.0 | 2018-03-29 | Hashicorp vagrant-vmware-fusion 5.0.4 allows local users to steal root privileges if VMware Fusion is not installed. |
CVE-2017-16512 | High | 7.8 | 2018-03-29 | The vagrant update process in Hashicorp vagrant-vmware-fusion 5.0.2 through 5.0.4 allows local users to steal root privileges via a crafted update request when… |
CVE-2018-9057 | Critical | 9.8 | 2018-03-27 | aws/resource_aws_iam_user_login_profile.go in the HashiCorp Terraform Amazon Web Services (AWS) provider through v1.12.0 has an inappropriate PRNG algorithm an… |
CVE-2017-16777 | High | 7.8 | 2017-11-16 | If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake applicati… |
CVE-2017-16001 | High | 7.8 | 2017-11-06 | In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can silently subvert the plugin update process in orde… |
CVE-2017-15884 | High | 7.0 | 2017-10-31 | In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.0, a local attacker or malware can silently subvert the plugin update process in orde… |
CVE-2017-12579 | High | 7.8 | 2017-10-19 | An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and earlier allows a non-root user to obtain a… |
CVE-2017-11741 | High | 8.8 | 2017-08-08 | HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo helper scripts, allows local users to execu… |
CVE-2017-7642 | High | 7.8 | 2017-08-02 | The sudo helper in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.21 allows local users to gain root privileges by leveragin… |