VDB
RHSA-2023%3A3342
RHSA-2023%3A3342
PUBLISHED
CVSS 8.199999809265137 HIGH
A flaw was found in Vault and Vault Enterprise (“Vault”). In the affected versions of Vault, with the AWS Auth Method configured and under certain circumstances, the values relied upon by Vault to validate AWS IAM identities and roles may be manipulated and bypass authentication.
Risk Scores
CVSS 3.1
8.199999809265137
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:bacc5365ec4112c87eb0b76e8f9d575168aa99632d19640dccf4d4bd0e5af598_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | * |
| Red Hat | openshift4/topology-aware-lifecycle-manager-precache-rhel8@sha256:bcb9b47340a555aa21e4b7e33f5686c52d177afd911ccc1b12c014c91de013e2_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/topology-aware-lifecycle-manager-precache-rhel8@sha256:bcb9b47340a555aa21e4b7e33f5686c52d177afd911ccc1b12c014c91de013e2_amd64, openshift4/topology-aware-lifecycle-manager-precache-rhel8@sha256:bcb9b47340a555aa21e4b7e33f5686c52d177afd911ccc1b12c014c91de013e2_amd64 |
| Red Hat | openshift4/ztp-site-generate-rhel8@sha256:ce030e999b4b19e26dd5c4712cdbee820bfefcb9950889b4b2bff3472750fd4c_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | * |
| Red Hat | openshift4/topology-aware-lifecycle-manager-rhel8-operator@sha256:f95b1ec957cf9af6085c1c64d7e389163632c47eccc520078c056e31958053e8_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/topology-aware-lifecycle-manager-rhel8-operator@sha256:f95b1ec957cf9af6085c1c64d7e389163632c47eccc520078c056e31958053e8_amd64, openshift4/topology-aware-lifecycle-manager-rhel8-operator@sha256:f95b1ec957cf9af6085c1c64d7e389163632c47eccc520078c056e31958053e8_amd64 |
| Red Hat | openshift4/topology-aware-lifecycle-manager-rhel8-operator@sha256:f95b1ec957cf9af6085c1c64d7e389163632c47eccc520078c056e31958053e8_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | * |
| Red Hat | openshift4/topology-aware-lifecycle-manager-precache-rhel8@sha256:bcb9b47340a555aa21e4b7e33f5686c52d177afd911ccc1b12c014c91de013e2_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | * |
| Red Hat | openshift4/topology-aware-lifecycle-manager-operator-bundle@sha256:bacc5365ec4112c87eb0b76e8f9d575168aa99632d19640dccf4d4bd0e5af598_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | *, * |
| Red Hat | openshift4/ztp-site-generate-rhel8@sha256:ce030e999b4b19e26dd5c4712cdbee820bfefcb9950889b4b2bff3472750fd4c_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/ztp-site-generate-rhel8@sha256:ce030e999b4b19e26dd5c4712cdbee820bfefcb9950889b4b2bff3472750fd4c_amd64, openshift4/ztp-site-generate-rhel8@sha256:ce030e999b4b19e26dd5c4712cdbee820bfefcb9950889b4b2bff3472750fd4c_amd64 |
| Red Hat | openshift4/topology-aware-lifecycle-manager-recovery-rhel8@sha256:f2188c046127b960582b54e7922e553147c9f973f3d064367332c75ce5536c09_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | * |
| Red Hat | openshift4/topology-aware-lifecycle-manager-recovery-rhel8@sha256:f2188c046127b960582b54e7922e553147c9f973f3d064367332c75ce5536c09_amd64 as a component of Red Hat OpenShift Container Platform 4.13 | openshift4/topology-aware-lifecycle-manager-recovery-rhel8@sha256:f2188c046127b960582b54e7922e553147c9f973f3d064367332c75ce5536c09_amd64, openshift4/topology-aware-lifecycle-manager-recovery-rhel8@sha256:f2188c046127b960582b54e7922e553147c9f973f3d064367332c75ce5536c09_amd64 |
Timeline
- Jun 21, 2023 CVE Published
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Distribution Patch
- Apr 25, 2026 Security Advisory
- Apr 25, 2026 Security Advisory
- May 19, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2023:3342 advisory
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2167337 issue
- https://issues.redhat.com/browse/OCPBUGS-13161 advisory
- https://issues.redhat.com/browse/OCPBUGS-13700 advisory
- https://issues.redhat.com/browse/OCPBUGS-7422 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3342.json advisory
- https://access.redhat.com/security/cve/CVE-2020-16250 advisory
- https://www.cve.org/CVERecord?id=CVE-2020-16250 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-16250 advisory
- https://discuss.hashicorp.com/t/hcsec-2020-16-vault-s-aws-auth-method-allows-authentication-bypass/18101 advisory