CVE-2021-27400: 
HashiCorp Vault vulnerability analysis and mitigation

HashiCorp Vault and Vault Enterprise Cassandra integrations (storage backend and database secrets engine plugin) were found to have a security vulnerability where TLS certificates were not being validated when connecting to Cassandra clusters. The vulnerability, identified as CVE-2021-27400, was discovered and reported by Martin Sucha to HashiCorp. The issue was publicly disclosed on April 21, 2021, and was subsequently fixed in versions 1.6.4 and 1.7.1 (HashiCorp Advisory).

The vulnerability is classified as CWE-295 (Improper Certificate Validation). According to the National Vulnerability Database, it received a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N, and a CVSS v2.0 Base Score of 5.0 (MEDIUM) with the vector string (AV:N/AC:L/Au:N/C:N/I:P/A:N) (NVD Database).

The vulnerability affected both the Cassandra storage backend used to persist Vault's data and the Cassandra database secrets engine plugin that generates dynamic database credentials. Due to the lack of TLS certificate validation, Vault may have connected to Cassandra clusters without adequately verifying the trustworthiness of the remote service and connection, potentially exposing the system to man-in-the-middle attacks (HashiCorp Advisory).

HashiCorp addressed this vulnerability by releasing fixed versions 1.6.4 and 1.7.1 of both Vault and Vault Enterprise. Users of the Vault Cassandra integrations were advised to evaluate the associated risks and upgrade to these or newer versions. The vendor provided upgrade guidance through their standard Vault upgrading documentation (HashiCorp Advisory).