{"id":"CVE-2020-25816","published":"2020-09-30T19:44:01Z","modified":"2024-08-04T15:40:36Z","title":"HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their…","vendor":null,"product":null,"tier":"tail","description":{"text":"HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01012,"percentile":0.63132,"provenance":"source"},"cwes":[],"references":[{"url":"https://www.hashicorp.com/blog/category/vault","tags":["x_refsource_MISC"]},{"url":"https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#154","tags":["x_refsource_CONFIRM"]}],"priority":{"score":12.6,"factors":[{"name":"EPSS percentile","points":12.63}]},"affected":[{"ecosystem":"Go","package":"github.com/hashicorp/vault","vulnerableRanges":[">=1.0.0-beta1, <1.5.4",">=1.0.0, <1.5.4"],"patched":["1.5.4"],"from":["GHSA-57gg-cj55-q5g2","GO-2024-2514"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2522","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-github-com-hashicorp-vault-cve-2020-10660","parents":[{"from":"CVE-2020-10660","to":"CVE-2020-25816","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["vault/expiration.go","vault/request_handling.go"],"commits":["https://github.com/hashicorp/vault/commit/18485ee9d4352ac8e8396c580b5941ccf8e5b31a","https://github.com/hashicorp/vault/commit/f192878110fe93eb13da914b2bee28caa7866a29"],"basis":"rarely changed file"}]},{"from":"CVE-2020-10661","to":"CVE-2020-25816","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["vault/expiration.go","vault/request_handling.go"],"commits":["https://github.com/hashicorp/vault/commit/18485ee9d4352ac8e8396c580b5941ccf8e5b31a","https://github.com/hashicorp/vault/commit/f192878110fe93eb13da914b2bee28caa7866a29"],"basis":"rarely changed file"}]}],"packageHistory":[{"cve":"CVE-2020-13223","published":"2020-06-10","fixed":"1.4.2","kev":false},{"cve":"CVE-2020-16250","published":"2020-08-26","fixed":"1.5.1","kev":false},{"cve":"CVE-2020-16251","published":"2020-08-26","fixed":"1.5.1","kev":false,"link":{"from":"CVE-2020-16251","to":"CVE-2020-25816","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/hashicorp/vault","fromFixed":"1.5.1","toFixed":"1.5.4","daysApart":35}]}},{"cve":"CVE-2020-25816","published":"2020-09-30","fixed":"1.5.4","kev":false},{"cve":"CVE-2020-35177","published":"2020-12-17","fixed":"1.6.1","kev":false,"link":{"from":"CVE-2020-25816","to":"CVE-2020-35177","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/hashicorp/vault","fromFixed":"1.5.4","toFixed":"1.5.6","daysApart":78}]}},{"cve":"CVE-2021-3282","published":"2021-02-01","fixed":"1.6.2","kev":false},{"cve":"CVE-2021-32923","published":"2021-06-03","fixed":"1.7.2","kev":false}],"package":"Go:github.com/hashicorp/vault"}}