Threats tagged 'ghsa-w4qh-g6vc-38wx'

Vault's audit devices had a vulnerability where they did not validate the contents of a configured audit log prefix and inconsistently enforced the server-level restriction on audit log prefixing. This flaw could allow a privileged operator to inject misleading content into audit logs, potentially forging audit records. The issue is fixed in Vault Community Edition 2.2.2 and Vault Enterprise versions 2.2.2, 1.21.14, and 1.19.25.