HashiCorp Vault and Vault Enterprise Userpass Auth Timing Side-Channel Vulnerability

A timing side-channel vulnerability has been identified in the userpass authentication method of HashiCorp Vault and Vault Enterprise. This issue allows an attacker to differentiate between existing and non-existing users, potentially leading to the enumeration of valid usernames. The vulnerability arises from an improper handling of username verification, which could be exploited to gather information about user accounts. Affected versions include Vault Community Edition up to 1.20.0 and Vault Enterprise up to 1.20.0, 1.19.6, 1.18.11, 1.16.22, and 1.15.15.

Impact

Exploitation of this vulnerability could allow for the enumeration of usernames in the userpass authentication method, potentially leading to unauthorized access if combined with other information or vulnerabilities.

Remediation

Users are advised to upgrade to Vault Community Edition 1.20.1 or Vault Enterprise 1.20.1, 1.19.7, 1.18.12, or 1.16.23.