HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Vault | Hashicorp | 0.10.0 (including) | 1.5.9 (excluding) |
| Vault | Hashicorp | 1.6.0 (including) | 1.6.5 (excluding) |
| Vault | Hashicorp | 1.7.0 (including) | 1.7.2 (excluding) |