What is GHSA-hwc3-3qh6-r4gg?

GHSA-hwc3-3qh6-r4gg is a security advisory published by GitHub Security Advisories with Medium severity. HashiCorp Vault's PKI mount vulnerable to denial of service

Which CVE IDs does GHSA-hwc3-3qh6-r4gg cover?

GHSA-hwc3-3qh6-r4gg covers the following CVE IDs: CVE-2023-0665. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-hwc3-3qh6-r4gg?

GHSA-hwc3-3qh6-r4gg has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-hwc3-3qh6-r4gg?

GHSA-hwc3-3qh6-r4gg affects 3 products, including: go/github.com/hashicorp/vault:\u003c 1.11.9; go/github.com/hashicorp/vault:\u003e= 1.12.0, \u003c 1.12.5; go/github.com/hashicorp/vault:\u003e= 1.13.0, \u003c 1.13.1.

GHSA-hwc3-3qh6-r4ggMediumCVSS 6.5

HashiCorp Vault's PKI mount vulnerable to denial of service

Vendor

GitHub Security Advisories

Published

March 30, 2023

Last Modified

May 26, 2023

🔗 CVE IDs covered (1)

CVE-2023-0665 →

📋 Description

HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

🎯 Affected products3

go/github.com/hashicorp/vault:< 1.11.9
go/github.com/hashicorp/vault:>= 1.12.0, < 1.12.5
go/github.com/hashicorp/vault:>= 1.13.0, < 1.13.1

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2023-0665
https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1
https://security.netapp.com/advisory/ntap-20230526-0008/
https://github.com/advisories/GHSA-hwc3-3qh6-r4gg