Описание
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.
A flaw was found in OpenBao. When OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, it failed to use proper database quoting on schema names. This oversight could lead to role revocation failures or, in rarer instances, allow a management user to perform SQL injection.
Меры по смягчению последствий
To mitigate this issue, audit table schemas within the PostgreSQL database used by OpenBao. Ensure that database users are restricted from creating new schemas and granting privileges on them. This operational control helps prevent the conditions that could lead to SQL injection during role privilege revocation. A restart or service reload of OpenBao may be required for these changes to take full effect.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | cryostat/cryostat-storage-rhel9 | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
4.9 Medium
CVSS3
Связанные уязвимости
OpenBao is an open source identity-based secrets management system. Prior to version 2.5.3, when OpenBao revoked privileges on a role in the PostgreSQL database secrets engine, OpenBao failed to use proper database quoting on schema names provided by PostgreSQL. This could lead to role revocation failures, or more rarely, SQL injection as the management user. This vulnerability was original from HashiCorp Vault. The vulnerability is addressed in v2.5.3. As a workaround, audit table schemas and ensure database users cannot create new schemas and grant privileges on them.
OpenBao is an open source identity-based secrets management system. Pr ...
OpenBao's SQL Injection in PostgreSQL database secrets engine
Уязвимость системы управления секретами и шифрованием OpenBao, связанная с непринятием мер по защите структуры запроса SQL, позволяющая нарушителю выполнить произвольный код
EPSS
4.9 Medium
CVSS3