HashiCorp Vault and Vault Enterprise allowed the renewal of nearly-expired token leases and dynamic secret leases (specifically, those within 1 second of their maximum TTL), which caused them to be incorrectly treated as non-expiring during subsequent use. Fixed in 1.5.9, 1.6.5, and 1.7.2.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/hashicorp/vault(Go) | 1.7.0 | 1.7.2 | N/A |
| github.com/hashicorp/vault(Go) | 1.6.0 | 1.6.5 | N/A |
| github.com/hashicorp/vault(Go) | 0.10.0 | 1.5.9 | N/A |
CVSS Metrics
