What is GHSA-23fq-q7hc-993r?

GHSA-23fq-q7hc-993r is a security advisory published by GitHub Security Advisories with Critical severity. HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0

Which CVE IDs does GHSA-23fq-q7hc-993r cover?

GHSA-23fq-q7hc-993r covers the following CVE IDs: CVE-2021-38553. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-23fq-q7hc-993r?

GHSA-23fq-q7hc-993r has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

Which products are affected by GHSA-23fq-q7hc-993r?

GHSA-23fq-q7hc-993r affects 1 product, including: go/github.com/hashicorp/vault:\u003e= 1.4.0, \u003c 1.8.0.

GHSA-23fq-q7hc-993rCriticalCVSS 9.8

HashiCorp Vault underlying database had excessively broad filesystem permissions from v1.4.0 until v1.8.0

Vendor

GitHub Security Advisories

Published

August 30, 2021

Last Modified

January 30, 2023

🔗 CVE IDs covered (1)

CVE-2021-38553 →

📋 Description

HashiCorp Vault and Vault Enterprise 1.4.0 through 1.7.3 initialized an underlying database file associated with the Integrated Storage feature with excessively broad filesystem permissions. Fixed in Vault and Vault Enterprise 1.8.0.

🎯 Affected products1

go/github.com/hashicorp/vault:>= 1.4.0, < 1.8.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2021-38553
https://discuss.hashicorp.com/t/hcsec-2021-20-vault-s-integrated-storage-backend-database-file-may-have-excessively-broad-permissions/28168
https://security.gentoo.org/glsa/202207-01
https://github.com/advisories/GHSA-23fq-q7hc-993r