Skip to content

x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-57gg-cj55-q5g2 #2514

New issue
New issue
Closed
Closed
x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-57gg-cj55-q5g2#2514
Assignees
timothy-king
Labels
excluded: EFFECTIVELY_PRIVATEThis vulnerability exists in a package can be imported, but isn't meant to be outside that module.
@GoVulnBot

Description

@GoVulnBot
GoVulnBot
opened on Feb 1, 2024

In GitHub Security Advisory GHSA-57gg-cj55-q5g2, there is a vulnerability in the following Go packages or modules:

Unit Fixed Vulnerable Ranges
github.com/hashicorp/vault 1.5.4 >= 1.0, < 1.5.4

Cross references:

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/hashicorp/vault
      versions:
        - introduced: 1.0.0
          fixed: 1.5.4
      vulnerable_at: 1.5.3
      packages:
        - package: github.com/hashicorp/vault
summary: Token leases could outlive their TTL in HashiCorp Vault
cves:
    - CVE-2020-25816
ghsas:
    - GHSA-57gg-cj55-q5g2
references:
    - web: https://nvd.nist.gov/vuln/detail/CVE-2020-25816
    - fix: https://github.com/hashicorp/vault/pull/10020/commits/f192878110fe93eb13da914b2bee28caa7866a29
    - web: https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#147
    - web: https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#154
    - web: https://www.hashicorp.com/blog/category/vault
    - advisory: https://github.com/advisories/GHSA-57gg-cj55-q5g2

Metadata

Metadata

Assignees

Labels

excluded: EFFECTIVELY_PRIVATEThis vulnerability exists in a package can be imported, but isn't meant to be outside that module.

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions