-
Notifications
You must be signed in to change notification settings - Fork 4.3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
When restoring a key in transit engine, path is not correctly validated #7663
Labels
Comments
I've opened #7998 to address this, hopefully it gets approved and merged 😄 |
catsby
added a commit
that referenced
this issue
Dec 11, 2019
* Add test to verify #7663 * Validate name in transit key restore to not be a path
#7998 was merged, thanks again for reporting this! |
briankassouf
pushed a commit
that referenced
this issue
Dec 18, 2019
* Add test to verify #7663 * Validate name in transit key restore to not be a path
briankassouf
added a commit
that referenced
this issue
Dec 18, 2019
* Output human duration in TTL warnings (#7901) * Add enable_hostname_label option to telementry stanza (#7902) * store secret key and value as an object to fix copy/show secret bug (#7926) * Add accept header check for prometheus mime type (#7958) * Add accept header check for prometheus mime type * Fix small header filter bug. Add test * Fix S3 configurable path handling (#7966) Also remove some incorrect skipping of the S3 test. Fixes #7362 * Ui/fix demoting status menu (#7997) * fix bug where users couldn't click on update primary * don't show status menu items when cluster isSecondary since those links don't work * show the mode of replication in the status menu * do not show server header in status menu when the contents are empty * show Disaster Recovery instead of 'DR' * do not show http metrics in status menu unless user is authenticated * fix typo so icons in status menu show * Transit: error when restoring to a name that looks like a path (#7998) * Add test to verify #7663 * Validate name in transit key restore to not be a path * overwrite bulma bug that crashes safari (#8023)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Steps to reproduce the behavior:
vault write /transit/keys/test-key type=rsa-2048 exportable=true allow_plaintext_backup=true
vault read --field=backup /transit/backup/test-key | vault write /transit/restore/sub/path/test-key2 backup=-
sub
is listed as a sub-path in/transit/keys/
but one can not list that sub-path nor do any operation related to the keyExpected behavior
When doing restore, vault should fail if the name of the key is incorrect.
Environment:
vault status
): 1.2.3vault version
): v1.2.2Transit ACLs used:
The text was updated successfully, but these errors were encountered: