CVE-2024-7594
Fixed in a distro release EPSS <1%CVSS 7.5
Vault’s SSH secrets engine did not require the valid_principals list to contain a value by default. If the valid_principals and default_user fields of the SSH secrets engine configuration are not set, an SSH certificate requested by an authorized user to Vault’s SSH secrets engine could be used to authenticate as any user on the host. Fixed in Vault Community Edition 1.17.6, and in Vault Enterprise 1.17.6, 1.16.10, and 1.15.15.
Products: HashiCorp Vault, HashiCorp Vault Enterprise, hashicorp vault_community_edition
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/hashicorp/vault | 1.17.6 |
| Go | github.com/openbao/openbao | no fix |
| Go | github.com/openbao/openbao | 0.0.0-20241003222810-d5b4e9224698 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | vault-1.16 | no fix |
| Chainguard | vault-1.17 | 1.17.6-r9 |
| Chainguard | vault-1.17-compat | 1.17.6-r9 |
| Chainguard | vault-fips-1.17 | 1.17.6-r0 |
| Chainguard | vault-fips-1.17-compat | 1.17.6-r0 |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | govulncheck-vulndb | 0.0.20241030T212825-150000.1.9.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0.0.20241030T212825-150000.1.9.1 |
| SUSE Package Hub 12 | govulncheck-vulndb | 0.0.20241104T154416-5.1 |
| openSUSE Leap 15.5 | govulncheck-vulndb | 0.0.20241030T212825-150000.1.9.1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20241030T212825-150000.1.9.1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20241030T212825-1.1 |