Описание
Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
A flaw was found in Vault’s PKI engine. The ACME (Automated Certificate Management Environment) validation process did not properly restrict requests to local network targets when handling http-01 and tls-alpn-01 challenges. This vulnerability, known as Server-Side Request Forgery (SSRF), could allow a remote attacker to send crafted ACME validation challenges, potentially leading to the disclosure of sensitive information from internal network resources.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenShift Container Platform 4 | openshift4/ose-baremetal-installer-rhel9 | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift4/ose-installer-rhel9 | Fix deferred | ||
| Red Hat Openshift Data Foundation 4 | cephcsi-rhel8 | Fix deferred | ||
| Red Hat Openshift Data Foundation 4 | cephcsi-rhel9 | Fix deferred | ||
| Red Hat Openshift Data Foundation 4 | mcg-cli-rhel9 | Fix deferred | ||
| Red Hat Openshift Data Foundation 4 | mcg-rhel8-operator | Fix deferred | ||
| Red Hat Openshift Data Foundation 4 | mcg-rhel9-operator | Fix deferred | ||
| Red Hat Openshift Data Foundation 4 | ocs4/cephcsi-rhel8 | Fix deferred | ||
| Red Hat Openshift Data Foundation 4 | odf4/cephcsi-rhel8 | Fix deferred | ||
| Red Hat Openshift Data Foundation 4 | odf4/cephcsi-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.8 Medium
CVSS3
Связанные уязвимости
Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges. This may lead to these requests being sent to local network targets, potentially leading to information disclosure. Fixed in Vault Community Edition 2.0.0 and Vault Enterprise 2.0.0, 1.21.5, 1.20.10, and 1.19.16.
HashiCorp Vault has Server-Side Request Forgery in ACME Challenge Validation via Attacker-Controlled DNS
Уязвимость механизма PKI Vault платформ для архивирования корпоративной информации HashiCorp Vault Community Edition и Vault Enterprise, позволяющая нарушителю раскрыть конфиденциальную информацию
EPSS
5.8 Medium
CVSS3