Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-2qmw-pvf7-4mw6 #2982

Closed
GoVulnBot opened this issue Jul 12, 2024 · 2 comments
Closed

x/vulndb: potential Go vuln in github.com/hashicorp/vault: GHSA-2qmw-pvf7-4mw6 #2982

GoVulnBot opened this issue Jul 12, 2024 · 2 comments
Labels
triaged

Comments

@GoVulnBot
Copy link

Advisory GHSA-2qmw-pvf7-4mw6 references a vulnerability in the following Go modules:

Module
github.com/hashicorp/vault

Description:
Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxy_protocol_behavior, was set to deny_unauthorized. When receiving a request from a source IP address that was not listed in proxy_protocol_authorized_addrs, the Vault API server would shut down and no longer respond to any HTTP requests, potentially resulting in denial of service.

While this bug also affected versions of Vault up to 1.17.1 and 1.16.5, a separate regression in those release series did not allow Vault operators to configure the deny_unauthoriz...

References:

Cross references:

See doc/triage.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/hashicorp/vault
      versions:
        - introduced: 1.16.0-rc1
        - fixed: 1.16.3
        - introduced: 1.17.0-rc1
        - fixed: 1.17.2
      non_go_versions:
        - fixed: 1.15.12
      vulnerable_at: 1.17.1
summary: |-
    Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional
    Conditions in github.com/hashicorp/vault
cves:
    - CVE-2024-6468
ghsas:
    - GHSA-2qmw-pvf7-4mw6
references:
    - advisory: https://github.com/advisories/GHSA-2qmw-pvf7-4mw6
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-6468
    - web: https://discuss.hashicorp.com/t/hcsec-2024-14-vault-vulnerable-to-denial-of-service-when-setting-a-proxy-protocol-behavior/68518
source:
    id: GHSA-2qmw-pvf7-4mw6
    created: 2024-07-12T15:01:17.470465637Z
review_status: UNREVIEWED
@gopherbot
Copy link
Contributor

Change https://go.dev/cl/597995 mentions this issue: data/reports: add 3 reports

@gopherbot
Copy link
Contributor

Change https://go.dev/cl/606360 mentions this issue: data/reports: regenerate 8 reports

gopherbot pushed a commit that referenced this issue Aug 19, 2024
@tatianab @gopherbot
data/reports: regenerate 8 reports
9fd9786 
  - data/reports/GO-2024-2993.yaml
  - data/reports/GO-2024-2997.yaml
  - data/reports/GO-2024-3033.yaml
  - data/reports/GO-2024-3039.yaml
  - data/reports/GO-2024-2921.yaml
  - data/reports/GO-2024-2982.yaml
  - data/reports/GO-2024-3066.yaml
  - data/reports/GO-2024-3070.yaml

Updates #2993
Updates #2997
Updates #3033
Updates #3039
Updates #2921
Updates #2982
Updates #3066
Updates #3070

Change-Id: I5a682ceba4983a42b0d7783535488c5ecf049f25
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/606360
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Auto-Submit: Tatiana Bradley <tatianabradley@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
@GoVulnBot GoVulnBot mentioned this issue Sep 3, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue Sep 26, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue Oct 10, 2024
Closed
@GoVulnBot GoVulnBot mentioned this issue Oct 31, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
triaged
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@zpavlinovic @gopherbot @GoVulnBot