Vulnerability Description
HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the engine-configured setting. This may lead to generated GCP credentials being valid for longer than intended. Fixed in 1.4.2.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Hashicorp | Vault | >= 1.4.0, < 1.4.2 |
Related Weaknesses (CWE)
References
- https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#142-may-21st-2020Release NotesVendor Advisory
- https://www.hashicorp.com/blog/category/vault/Vendor Advisory
- https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#142-may-21st-2020Release NotesVendor Advisory
- https://www.hashicorp.com/blog/category/vault/Vendor Advisory
FAQ
What is CVE-2020-12757?
CVE-2020-12757 is a vulnerability with a CVSS score of 9.8 (CRITICAL). HashiCorp Vault and Vault Enterprise 1.4.0 and 1.4.1, when configured with the GCP Secrets Engine, may incorrectly generate GCP Credentials with the default time-to-live lease duration instead of the ...
How severe is CVE-2020-12757?
CVE-2020-12757 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2020-12757?
Check the references section above for vendor advisories and patch information. Affected products include: Hashicorp Vault.