{"id":"CVE-2020-25816","published":"2020-09-30T19:44:01Z","modified":"2024-08-04T15:40:36Z","title":"HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their…","vendor":null,"product":null,"tier":"tail","description":{"text":"HashiCorp Vault and Vault Enterprise versions 1.0 and newer allowed leases created with a batch token to outlive their TTL because expiration time was not scheduled correctly. Fixed in 1.4.7 and 1.5.4.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01012,"percentile":0.63219,"provenance":"source"},"cwes":[],"references":[{"url":"https://www.hashicorp.com/blog/category/vault","tags":["x_refsource_MISC"]},{"url":"https://github.com/hashicorp/vault/blob/master/CHANGELOG.md#154","tags":["x_refsource_CONFIRM"]}],"priority":{"score":12.6,"factors":[{"name":"EPSS percentile","points":12.64}]},"affected":[{"ecosystem":"Go","package":"github.com/hashicorp/vault","vulnerableRanges":[">=1.0.0-beta1, <1.5.4",">=1.0.0, <1.5.4"],"patched":["1.5.4"],"from":["GHSA-57gg-cj55-q5g2","GO-2024-2514"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-2522","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-13223","published":"2020-06-10","fixed":"1.4.2","kev":false},{"cve":"CVE-2020-16250","published":"2020-08-26","fixed":"1.5.1","kev":false},{"cve":"CVE-2020-16251","published":"2020-08-26","fixed":"1.5.1","kev":false,"link":{"from":"CVE-2020-16251","to":"CVE-2020-25816","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/hashicorp/vault","fromFixed":"1.5.1","toFixed":"1.5.4","daysApart":35}]}},{"cve":"CVE-2020-25816","published":"2020-09-30","fixed":"1.5.4","kev":false},{"cve":"CVE-2020-35177","published":"2020-12-17","fixed":"1.6.1","kev":false,"link":{"from":"CVE-2020-25816","to":"CVE-2020-35177","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/hashicorp/vault","fromFixed":"1.5.4","toFixed":"1.5.6","daysApart":78}]}},{"cve":"CVE-2021-3282","published":"2021-02-01","fixed":"1.6.2","kev":false},{"cve":"CVE-2021-32923","published":"2021-06-03","fixed":"1.7.2","kev":false}],"package":"Go:github.com/hashicorp/vault"}}