CVE-2024-0831: Hashicorp Vault may expose sensitive log information
4.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.40642%
CWE
Published
2/1/2024
Updated
2/23/2024
KEV Status
No
Technology
Go
GoTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/vault | go | >= 1.15.0, < 1.15.5 | 1.15.5 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from how audit events were processed. The key changes in the patch show:
- The payload type changed from *auditEvent to *AuditEvent (indicating structural changes)
- A new AuditEvent (a2) is created with cloned data instead of using the original payload
- A new eventlogger.Event (e2) is created for output instead of modifying the input event
This demonstrates the original code processed events in a way that allowed cross-contamination between audit devices. The EntryFormatter.Process function was responsible for formatting audit data and passed the modified event to subsequent sinks, meaning any device with 'log_raw' enabled would leave raw data in the shared event payload that other devices could access.