CVE-2020-16250 2

Vulnerability (CVE)

Unexpected security footguns in Go

Trail of Bits reports that Go's JSON, XML, and YAML parsers have unexpected behaviors it has repeatedly exploited during security assessments to bypass authentication, circumvent authorization, and exfiltrate data, citing CVE-2020-16250, a HashiCorp Vault...

Zero-Days & Exploits

Enter the Vault: Authentication Issues in Hashi Corp Vault

Cyber Risks Google Project Zero

Google Project Zero's Felix Wilhelm found two vulnerabilities, CVE-2020-16250 and CVE-2020-16251, in HashiCorp Vault's aws and gcp auth methods that can lead to authentication bypass; HashiCorp fixed them in Vault versions 1.2.5, 1.3.8, 1.4.4 and 1.5.1...

Cloud Security