Publish Advisories

GHSA-j6vv-vv26-rh7c GHSA-m979-w9wj-qfj9
2026-05-22 18:04:22 -07:00 · 2024-01-30 23:42:00 +00:00
parent 1bfc0b1407
commit 71b86de5cd
2 changed files with 134 additions and 0 deletions
@@ -0,0 +1,65 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-j6vv-vv26-rh7c",
+  "modified": "2024-01-30T23:40:40Z",
+  "published": "2024-01-30T23:40:40Z",
+  "aliases": [
+    "CVE-2020-10661"
+  ],
+  "summary": "HashiCorp Vault Improper Privilege Management",
+  "details": "HashiCorp Vault and Vault Enterprise versions 0.11.0 through 1.3.3 may, under certain circumstances, have existing nested-path policies grant access to Namespaces created after-the-fact. Fixed in 1.3.4.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/hashicorp/vault/vault"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.11.0"
+            },
+            {
+              "fixed": "1.3.4"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10661"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hashicorp/vault/commit/18485ee9d4352ac8e8396c580b5941ccf8e5b31a"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#134-march-19th-2020"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.hashicorp.com/blog/category/vault/"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-269"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-30T23:40:40Z",
+    "nvd_published_at": null
+  }
+}
@@ -0,0 +1,69 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-m979-w9wj-qfj9",
+  "modified": "2024-01-30T23:40:43Z",
+  "published": "2024-01-30T23:40:43Z",
+  "aliases": [
+    "CVE-2020-10660"
+  ],
+  "summary": "HashiCorp Vault Improper Privilege Management",
+  "details": "HashiCorp Vault and Vault Enterprise versions 0.9.0 through 1.3.3 may, under certain circumstances, have an Entity's Group membership inadvertently include Groups the Entity no longer has permissions to. Fixed in 1.3.4.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/hashicorp/vault/vault"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0.9.0"
+            },
+            {
+              "fixed": "1.3.4"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10660"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hashicorp/vault/pull/8606"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hashicorp/vault/commit/18485ee9d4352ac8e8396c580b5941ccf8e5b31a"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#134-march-19th-2020"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.hashicorp.com/blog/category/vault/"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-269"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-30T23:40:43Z",
+    "nvd_published_at": null
+  }
+}