Security

Topic	Replies	Views	Activity
HCSEC-2023-26 - Terraform’s Handling Of Duplicate Map Keys In Configurations May Have Security Implications security-terraform	0	7218	August 24, 2023
HCSEC-2023-25 - Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers security-consul	0	7818	August 8, 2023
HCSEC-2023-24 - Vault's LDAP Auth Method Allows for User Enumeration security-vault	0	8159	July 31, 2023
HCSEC-2023-23 - Vault Enterprise Namespace Creation May Lead to Denial of Service security-vault	0	7894	July 28, 2023
HCSEC-2023-22 - Nomad Search API Leaks Information About CSI Plugins security-nomad	0	5685	July 19, 2023
HCSEC-2023-21 - Nomad Caller ACL Token's Secret ID is Exposed to Sentinel security-nomad	0	5567	July 19, 2023
HCSEC-2023-20 - Nomad ACL Policies without Label are Applied to Unexpected Resources security-nomad	0	5776	July 19, 2023
HCSEC-2023-19 - Terraform Enterprise, Docker Engine, and Go’s CVE-2023-24540 security-terraform	1	7039	June 28, 2023
HCSEC-2023-18 - Terraform Enterprise Agent Pool Controls Allowed Unauthorized Workspaces to Target an Agent Pool security-terraform	0	6104	June 22, 2023
HCSEC-2023-17 - Vault’s KV Diff Viewer Allowed HTML Injection security-vault	0	6703	June 9, 2023
HCSEC-2023-16 - Consul Envoy Extension Downstream Proxy Configuration By Upstream Service Owner security-consul	0	6143	June 2, 2023
HCSEC-2023-15 - Consul Cluster Peering can Result in Denial of Service security-consul	0	6371	June 2, 2023
HCSEC-2023-14 - Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-Based Encryption Mechanism with a HSM security-vault	0	6007	May 1, 2023
HCSEC-2023-13 - Nomad Unauthenticated Client Agent HTTP Request Privilege Escalation	0	6013	April 5, 2023
HCSEC-2023-12 - Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File security-vault	0	7298	March 30, 2023
HCSEC-2023-11 - Vault’s PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata security-vault	0	6219	March 30, 2023
HCSEC-2023-10 - Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations security-vault	0	7700	March 30, 2023
HCSEC-2023-09 - Nomad ACLs Can Not Deny Access to Workload's Own Variables security-nomad	0	5235	March 13, 2023
HCSEC-2023-08 - Nomad Job Submitter Privilege Escalation Using Workload Identity security-nomad	0	5236	March 13, 2023
HCSEC-2023-07 - Vault Fails to Verify if Approle SecretID Belongs to Role During a Destroy Operation security-vault	0	6637	March 10, 2023
HCSEC-2023-06 - Consul Server Panic when Ingress and API Gateways Configured with Peering Connections	0	5674	March 9, 2023
HCSEC-2023-05 - Nomad Client Vulnerable to Decompression Bombs in Artifact Block	0	5148	February 16, 2023
HCSEC-2023-04 - go-getter vulnerable to denial of service via malicious compressed archive	0	6640	February 13, 2023
HCSEC-2023-03 - Boundary Workers Store Rotated Credentials in Plaintext Even When Key Management Service Configured security-boundary	0	5012	February 8, 2023
HCSEC-2023-02 - Vault, Consul, Boundary, and Waypoint Affected By Denial of Service in Go’s net/http (CVE-2022-41717) security-consul , security-vault , security-boundary , security-waypoint	0	5286	February 8, 2023
HCSEC-2023-01 - HashiCorp Response to CircleCI Security Alert	3	13965	April 24, 2023
HCSEC-2022-28 - Consul Cluster Peering Leaks Imported Nodes/Services Information security-consul	0	6265	November 15, 2022
HCSEC-2022-27 - HashiCorp Response to OpenSSL Security Announcement Regarding November 1 Release	2	5296	November 1, 2022
HCSEC-2022-26 - Nomad’s Event Stream Subscriber Using ACL Token with TTL Receive Updates Until Garbage Collected security-nomad	0	5869	October 28, 2022
HCSEC-2022-25 - Nomad’s Workload Identity Token Can List Non-sensitive Metadata For nomad/ Paths security-nomad	0	5906	October 28, 2022