HashiCorp Vault and Vault Enterprise disclosed the internal IP address of the Vault node when responding to some invalid, unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Vault | Hashicorp | * | 1.5.7 (excluding) |
| Vault | Hashicorp | 1.6.0 (including) | 1.6.2 (excluding) |
References
- https://discuss.hashicorp.com/t/hcsec-2021-02-vault-api-endpoint-exposed-internal-ip-address-without-authentication/20334
- https://security.gentoo.org/glsa/202207-01
- https://discuss.hashicorp.com/t/hcsec-2021-02-vault-api-endpoint-exposed-internal-ip-address-without-authentication/20334
- https://security.gentoo.org/glsa/202207-01