What is GHSA-fp52-qw33-mfmw?

GHSA-fp52-qw33-mfmw is a security advisory published by GitHub Security Advisories with High severity. Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault

Which CVE IDs does GHSA-fp52-qw33-mfmw cover?

GHSA-fp52-qw33-mfmw covers the following CVE IDs: CVE-2020-16250. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fp52-qw33-mfmw?

GHSA-fp52-qw33-mfmw has a CVSS v3 base score of 8.2, published by GitHub Security Advisories.

Which products are affected by GHSA-fp52-qw33-mfmw?

GHSA-fp52-qw33-mfmw affects 4 products, including: go/github.com/hashicorp/vault:\u003e= 1.5.0, \u003c 1.5.1; go/github.com/hashicorp/vault:\u003e= 0.8.1, \u003c 1.2.5; go/github.com/hashicorp/vault:\u003e= 1.3.0, \u003c 1.3.8; go/github.com/hashicorp/vault:\u003e= 1.4.0, \u003c 1.4.4.

GHSA-fp52-qw33-mfmwHighCVSS 8.2

Authentication Bypass by Spoofing and Insufficient Verification of Data Authenticity in Hashicorp Vault

Vendor

GitHub Security Advisories

Published

August 2, 2021

Last Modified

August 29, 2023

🔗 CVE IDs covered (1)

CVE-2020-16250 →

📋 Description

HashiCorp Vault and Vault Enterprise versions 0.7.1 and newer, when configured with the AWS IAM auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1..

🎯 Affected products4

go/github.com/hashicorp/vault:>= 1.5.0, < 1.5.1
go/github.com/hashicorp/vault:>= 0.8.1, < 1.2.5
go/github.com/hashicorp/vault:>= 1.3.0, < 1.3.8
go/github.com/hashicorp/vault:>= 1.4.0, < 1.4.4

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2020-16250
https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#151
https://www.hashicorp.com/blog/category/vault/
http://packetstormsecurity.com/files/159478/Hashicorp-Vault-AWS-IAM-Integration-Authentication-Bypass.html
https://github.com/advisories/GHSA-fp52-qw33-mfmw