vault-java-driver silently disables TLS certificate verification (HashiCorp Vault Java client)
A Vault connection tool turns off security checks, letting others peek at data.
Summary
The Java client for HashiCorp Vault silently turns off certificate and hostname checks. An attacker on the network path can read Vault tokens and secrets and forge responses. Versions 5.2.0 through 6.2.3 are affected.
Affected when
- SslConfig passed to VaultConfig without calling build()
- SslConfig restored by Java deserialization
- VAULT_SSL_VERIFY set to a truthy value other than "true" (such as 1, yes or on)
What to do
Update to 7.0.0.
Products and platforms
CVE IDs
Times
First published
First seen