---

CVE-2021-29653 - log back

CVE-2021-29653 edited at 22 Apr 2021 18:15:08
Severity	- Unknown + Medium
Remote	- Unknown + Remote
Type	- Unknown + Certificate verification bypass
Description	+ HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL. Fixed in 1.5.8, 1.6.4, and 1.7.1.
References	+ https://discuss.hashicorp.com/t/hcsec-2021-09-vault-s-pki-engine-crl-may-exclude-revoked-but-unexpired-certificates-after-tidy/23461/2 + https://github.com/hashicorp/vault/pull/11367 + https://github.com/hashicorp/vault/commit/3144d8f14b749fac57f0970636b35c68fd673843
Notes

CVE-2021-29653 created at 22 Apr 2021 18:11:44