HashiCorp Discuss

Vault oidc/logout

bonareal January 3, 2022, 8:27am 4

Hi Stephen,
I found a solution.
It’s Not a Bug, It’s a Feature !!!

HCSEC-2021-19 - Vault’s UI Cached User-Viewed Secrets Between Shared Browser Sessions Security

Bulletin ID: HCSEC-2021-19 Affected Products / Versions: Vault and Vault Enterprise up to 1.7.3 and 1.6.5; fixed in 1.8.0, pending in 1.7.4 and 1.6.6. Publication Date: August 12, 2021 Summary The Vault UI erroneously cached and exposed user-viewed secrets between authenticated sessions in a single shared browser, if the browser window / tab was not refreshed or closed between logout and a subsequent login. This vulnerability, CVE-2021-38554, was fixed in Vault 1.8.0 and will be addressed in…

Have a good week.

show post in topic

Home
Categories
FAQ/Guidelines
Terms of Service
Privacy Policy

Powered by Discourse, best viewed with JavaScript enabled