"Vault and Vault Enterprise 1.8.0 through 1.8.8, and 1.9.3 allowed the PKI secrets engine under certain configurations to issue wildcard certificates to authorized users for a specified domain, even if the PKI role policy attribute allow_subdomains is set to false. Fixed in Vault Enterprise 1.8.9 and 1.9.4.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2022-03-07T21:45:16

Updated: 2024-08-03T04:36:06.555Z

Reserved: 2022-02-16T00:00:00

Link: CVE-2022-25243

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-03-10T17:47:06.927

Modified: 2024-11-21T06:51:51.990

Link: CVE-2022-25243

cve-icon Redhat

Severity : Moderate

Publid Date: 2022-03-10T00:00:00Z

Links: CVE-2022-25243 - Bugzilla