Threats tagged 'ghsa-4frw-2vwq-957r'

The vault-java-driver, a Java client for HashiCorp Vault, has a vulnerability where TLS certificate and hostname verification can be silently disabled in certain conditions despite the caller requesting verification. This occurs when an SslConfig is passed without calling build(), restored via Java deserialization, or when the VAULT_SSL_VERIFY environment variable is set to a truthy value other than "true". This causes the driver to install a trust-all SSLContext, allowing a network attacker to intercept and read Vault tokens and secrets and forge responses. The issue affects versions 5.2.0 through 6.2.3 and is fixed in version 7.0.0.