CVE-2024-8185
Fixed in a distro release EPSS <1%CVSS 7.5
Vault Community and Vault Enterprise (“Vault”) clusters using Vault’s Integrated Storage backend are vulnerable to a denial-of-service (DoS) attack through memory exhaustion through a Raft cluster join API endpoint . An attacker may send a large volume of requests to the endpoint which may cause Vault to consume excessive system memory resources, potentially leading to a crash of the underlying system and the Vault process itself. This vulnerability, CVE-2024-8185, is fixed in Vault Community 1.18.1 and Vault Enterprise 1.18.1, 1.17.8, and 1.16.12.
Products: HashiCorp Vault, HashiCorp Vault Enterprise
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/hashicorp/vault | 1.18.1 |
| Go | github.com/openbao/openbao | 2.0.3 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | vault-1.16 | no fix |
| Chainguard | vault-1.17 | no fix |
| Chainguard | vault-1.18 | 1.18.1-r0 |
| Chainguard | vault-1.18-compat | 1.18.1-r0 |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | govulncheck-vulndb | 0.0.20241104T154416-150000.1.12.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0.0.20241104T154416-150000.1.12.1 |
| SUSE Package Hub 12 | govulncheck-vulndb | 0.0.20241104T154416-5.1 |
| openSUSE Leap 15.5 | govulncheck-vulndb | 0.0.20241104T154416-150000.1.12.1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20241104T154416-150000.1.12.1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20241101T215616-1.1 |