vault: UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser
Published Aug 13, 2021
5.3
MEDIUMCVSS 3.1
EPSS 0.91%
Description
HashiCorp Vault and Vault Enterprise’s UI erroneously cached and exposed user-viewed secrets between sessions in a single shared browser. Fixed in 1.8.0 and pending 1.7.4 / 1.6.6 releases.
Affected products
No data.
No data.
Logging Subsystem for Red Hat OpenShift
openshift-logging/logging-loki-rhel9
Not affected
OpenShift Service Mesh 2.0
servicemesh
Not affected
Red Hat Advanced Cluster Management for Kubernetes 2
vault
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-installer
Will not fix
Red Hat OpenShift Container Platform 4
openshift4/topology-aware-lifecycle-manager-rhel8-operator
Will not fix
Red Hat Openshift Container Storage 4
ocs4/cephcsi-rhel8
Out of support scope
Red Hat Openshift Container Storage 4
ocs4/mcg-rhel8-operator
Out of support scope
Red Hat Openshift Container Storage 4
ocs4/ocs-rhel8-operator
Out of support scope
Red Hat Openshift Container Storage 4
ocs4/rook-ceph-rhel8-operator
Out of support scope
Red Hat Openshift Data Foundation 4
odf4/cephcsi-rhel9
Not affected
Red Hat Openshift Data Foundation 4
odf4/mcg-rhel9-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/ocs-rhel9-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/odf-multicluster-rhel9-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/odf-rhel9-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/odr-rhel9-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/rook-ceph-rhel9-operator
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Logging Subsystem for Red Hat OpenShift | openshift-logging/logging-loki-rhel9 | Not affected | n/a |
| OpenShift Service Mesh 2.0 | servicemesh | Not affected | n/a |
| Red Hat Advanced Cluster Management for Kubernetes 2 | vault | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-installer | Will not fix | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/topology-aware-lifecycle-manager-rhel8-operator | Will not fix | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/cephcsi-rhel8 | Out of support scope | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/mcg-rhel8-operator | Out of support scope | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/ocs-rhel8-operator | Out of support scope | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/rook-ceph-rhel8-operator | Out of support scope | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/cephcsi-rhel9 | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/mcg-rhel9-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/ocs-rhel9-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odf-multicluster-rhel9-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odf-rhel9-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odr-rhel9-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/rook-ceph-rhel9-operator | Not affected | n/a |
github.com/hashicorp/vault
Go
Introduced 1.7.0 Fixed 1.7.4github.com/hashicorp/vault
Go
Introduced 0 Fixed 1.6.6
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/hashicorp/vault | 1.7.0 | 1.7.4 |
| Go | github.com/hashicorp/vault | 0 | 1.6.6 |
Remediation
Red Hat statement
The Vault deployments that do not enable the Vault UI are not affected by this issue.
References (10)
- https://access.redhat.com/security/cve/CVE-2021-38554 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1995207 Issue Tracking
- https://discuss.hashicorp.com/t/hcsec-2021-19-vault-s-ui-cached-user-viewed-secrets-between-shared-browser-sessions/28166 x_refsource_MISCVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1586 Advisory
- https://github.com/advisories/GHSA-6239-28c2-9mrm Advisory
- https://github.com/hashicorp/vault/releases/tag/v1.6.6
- https://github.com/hashicorp/vault/releases/tag/v1.7.4
- https://nvd.nist.gov/vuln/detail/CVE-2021-38554
- https://security.gentoo.org/glsa/202207-01 vendor-advisoryx_refsource_GENTOOThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-38554
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2021-38554 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1995207 | Issue Tracking | |
| https://discuss.hashicorp.com/t/hcsec-2021-19-vault-s-ui-cached-user-viewed-secrets-between-shared-browser-sessions/28166 | x_refsource_MISCVendor Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-1586 | Advisory | |
| https://github.com/advisories/GHSA-6239-28c2-9mrm | Advisory | |
| https://github.com/hashicorp/vault/releases/tag/v1.6.6 | ||
| https://github.com/hashicorp/vault/releases/tag/v1.7.4 | ||
| https://nvd.nist.gov/vuln/detail/CVE-2021-38554 | ||
| https://security.gentoo.org/glsa/202207-01 | vendor-advisoryx_refsource_GENTOOThird Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2021-38554 |
Change history (0)
No recorded changes yet.