CVE-2020-7220 - vault: Vault Enterprise’s Dynamic Secrets May Persist After Namespace Deletion

Back Back to CVE browser

HIGH

vault: Vault Enterprise’s Dynamic Secrets May Persist After Namespace Deletion

Published Jan 23, 2020

7.5

HIGH

CVSS 3.1

EPSS 1.42%

Description

HashiCorp Vault Enterprise 0.11.0 through 1.3.1 fails, in certain circumstances, to revoke dynamic secrets for a mount in a deleted namespace. Fixed in 1.3.2.

Affected products

Logging Subsystem for Red Hat OpenShift

openshift-logging/logging-loki-rhel9

Not affected
Red Hat OpenShift Container Platform 4

openshift4/ose-installer

Not affected
Red Hat OpenShift Container Platform 4

openshift4/topology-aware-lifecycle-manager-rhel8-operator

Not affected
Red Hat Openshift Container Storage 4

ocs4/cephcsi-rhel8

Not affected
Red Hat Openshift Container Storage 4

ocs4/mcg-rhel8-operator

Not affected
Red Hat Openshift Container Storage 4

ocs4/ocs-rhel8-operator

Not affected
Red Hat Openshift Container Storage 4

ocs4/rook-ceph-rhel8-operator

Not affected
Red Hat Openshift Data Foundation 4

odf4/cephcsi-rhel9

Not affected
Red Hat Openshift Data Foundation 4

odf4/mcg-rhel8-operator

Not affected
Red Hat Openshift Data Foundation 4

odf4/ocs-rhel8-operator

Not affected
Red Hat Openshift Data Foundation 4

odf4/odf-multicluster-rhel9-operator

Not affected
Red Hat Openshift Data Foundation 4

odf4/odf-rhel8-operator

Not affected
Red Hat Openshift Data Foundation 4

odf4/odr-rhel8-operator

Not affected
Red Hat Openshift Data Foundation 4

odf4/rook-ceph-rhel8-operator

Not affected

Product	Package	State	Advisory
Logging Subsystem for Red Hat OpenShift	openshift-logging/logging-loki-rhel9	Not affected	n/a
Red Hat OpenShift Container Platform 4	openshift4/ose-installer	Not affected	n/a
Red Hat OpenShift Container Platform 4	openshift4/topology-aware-lifecycle-manager-rhel8-operator	Not affected	n/a
Red Hat Openshift Container Storage 4	ocs4/cephcsi-rhel8	Not affected	n/a
Red Hat Openshift Container Storage 4	ocs4/mcg-rhel8-operator	Not affected	n/a
Red Hat Openshift Container Storage 4	ocs4/ocs-rhel8-operator	Not affected	n/a
Red Hat Openshift Container Storage 4	ocs4/rook-ceph-rhel8-operator	Not affected	n/a
Red Hat Openshift Data Foundation 4	odf4/cephcsi-rhel9	Not affected	n/a
Red Hat Openshift Data Foundation 4	odf4/mcg-rhel8-operator	Not affected	n/a
Red Hat Openshift Data Foundation 4	odf4/ocs-rhel8-operator	Not affected	n/a
Red Hat Openshift Data Foundation 4	odf4/odf-multicluster-rhel9-operator	Not affected	n/a
Red Hat Openshift Data Foundation 4	odf4/odf-rhel8-operator	Not affected	n/a
Red Hat Openshift Data Foundation 4	odf4/odr-rhel8-operator	Not affected	n/a
Red Hat Openshift Data Foundation 4	odf4/rook-ceph-rhel8-operator	Not affected	n/a

Ecosystem	Package	Introduced	Fixed
Go	github.com/hashicorp/vault	0.11.0	1.3.2

Remediation

Red Hat statement

Red Hat Products are not affected by this CVE as this CVE only affects HashiCorp Vault Enterprise versions.

Weaknesses (2)

CWE-200

Exposure of Sensitive Information

CWE-404

Improper Resource Shutdown or Release

References (8)

https://access.redhat.com/security/cve/CVE-2020-7220
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2189762
Issue Tracking
https://discuss.hashicorp.com/t/hcsec-2020-03-vault-enterprise-s-dynamic-secrets-may-persist-after-namespace-deletion/18086
https://github.com/advisories/GHSA-9vh5-r4qw-v3vv
Advisory
https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#132-january-22nd-2020
x_refsource_CONFIRMThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7220
https://www.cve.org/CVERecord?id=CVE-2020-7220
https://www.hashicorp.com/blog/category/vault/
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2020-7220		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2189762		Issue Tracking
https://discuss.hashicorp.com/t/hcsec-2020-03-vault-enterprise-s-dynamic-secrets-may-persist-after-namespace-deletion/18086
https://github.com/advisories/GHSA-9vh5-r4qw-v3vv		Advisory
https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#132-january-22nd-2020		x_refsource_CONFIRMThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-7220
https://www.cve.org/CVERecord?id=CVE-2020-7220
https://www.hashicorp.com/blog/category/vault/		x_refsource_MISCVendor Advisory