- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 202207-01
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Severity: Low
Title: HashiCorp Vault: Multiple Vulnerabilities
Date: July 29, 2022
Bugs: #768312, #797244, #808093, #817269, #827945, #829493, #835070, #845405
ID: 202207-01

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Synopsis
========

Multiple vulnerabilities have been discovered in HashiCorp Vault, the
worst of which could result in denial of service.

Background
==========

HashiCorp Vault is a tool for managing secrets.

Affected packages
=================

-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 app-admin/vault < 1.10.3 >= 1.10.3

Description
===========

Multiple vulnerabilities have been discovered in HashiCorp Vault. Please
review the CVE identifiers referenced below for details.

Impact
======

Please review the referenced CVE identifiers for details.

Workaround
==========

There is no known workaround at this time.

Resolution
==========

All HashiCorp Vault users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-admin/vault-1.10.3"

References
==========

[ 1 ] CVE-2020-25594
https://nvd.nist.gov/vuln/detail/CVE-2020-25594
[ 2 ] CVE-2021-27668
https://nvd.nist.gov/vuln/detail/CVE-2021-27668
[ 3 ] CVE-2021-3024
https://nvd.nist.gov/vuln/detail/CVE-2021-3024
[ 4 ] CVE-2021-3282
https://nvd.nist.gov/vuln/detail/CVE-2021-3282
[ 5 ] CVE-2021-32923
https://nvd.nist.gov/vuln/detail/CVE-2021-32923
[ 6 ] CVE-2021-37219
https://nvd.nist.gov/vuln/detail/CVE-2021-37219
[ 7 ] CVE-2021-38553
https://nvd.nist.gov/vuln/detail/CVE-2021-38553
[ 8 ] CVE-2021-38554
https://nvd.nist.gov/vuln/detail/CVE-2021-38554
[ 9 ] CVE-2021-41802
https://nvd.nist.gov/vuln/detail/CVE-2021-41802
[ 10 ] CVE-2021-43998
https://nvd.nist.gov/vuln/detail/CVE-2021-43998
[ 11 ] CVE-2021-45042
https://nvd.nist.gov/vuln/detail/CVE-2021-45042
[ 12 ] CVE-2022-25243
https://nvd.nist.gov/vuln/detail/CVE-2022-25243
[ 13 ] CVE-2022-30689
https://nvd.nist.gov/vuln/detail/CVE-2022-30689

Availability
============

This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:

https://security.gentoo.org/glsa/202207-01

Concerns?
=========

Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License
=======

Copyright 2022 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).

The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEpqTA6ABLMxh/aChGFMQkOaVy+9kFAmLoFCQACgkQFMQkOaVy +9nU9g//dyBp6SSRvFZeIgFINKzdSBZB29bOma6xdfmTWPJ8WspSI69JsOBdHd6p c6PwnrNzQ72AyC3bqha+fRL1Mj0CWe7ThRU0ZK/0gve6fWXDuiq0xgPY4cFBPMS7 7AYKteFIOXUj+j5vyCF3xxvuwwoOk0aKpfVv6b46pPXPNJ6wIDXCcPHv8HpbCDNb cNxC6fXvfiMUxLAYI0NoXWama7M4N1uHhXjzhV20vzvbWExT+NFe/Mip1tBTi3T7 1Am2pl44fePt42Oe99WtAR70IxJHc/LAcTLwo++RuSVDa3JYLIyX3LqeKR/1Gwy0 IMmyHLSS0A6cVYFHAgPgKIfhKIQ558kVJ/1ZIv2dJk/SJlnua+wZEWufaw4hVdsi SXck0miO+U1oFusfqV6f5lfk0PoJidkNlXchrynURrpRAM3P1TEWJZnK5AEgNfgG 4Rg/hH45NzKe57QvzwPed/Hp1hpY3ZQ/rdpOIA1apys+pA7mxFGUTlxPtv1Kyozp RGShCFIGeIfdBv8aIqLa4x/fzI0gU3qqsW9StocAlAe0b1espZeP6cTb04BxIunT 4VAGexZgPq/ctXmrUooWIEg/B2slKEhIwxZl9+LYg/H2Bsage0osm79tL7ct0ScC rBgckTmWKvOWkfnFcl80wxt8WY8Df7o/4czPTWKvFejz48yXG7I=
=xIO2
-----END PGP SIGNATURE-----

--- SoupGate-Win32 v1.05
* Origin: fsxNet Usenet Gateway (21:1/5)