{"api_version":"1","generated_at":"2026-07-23T18:36:45+00:00","cve":"CVE-2022-41316","urls":{"html":"https://cve.report/CVE-2022-41316","api":"https://cve.report/api/cve/CVE-2022-41316.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2022-41316","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2022-41316"},"summary":{"title":"CVE-2022-41316","description":"HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2022-10-12 21:15:00","updated_at":"2022-12-03 15:02:00"},"problem_types":["CWE-295"],"metrics":[],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first-request/45483","name":"https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first-request/45483","refsource":"MISC","tags":[],"title":"HCSEC-2022-24 - Vault's TLS Cert Auth Method Only Loaded CRL After First Request - Security - HashiCorp Discuss","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://security.netapp.com/advisory/ntap-20221201-0001/","name":"https://security.netapp.com/advisory/ntap-20221201-0001/","refsource":"CONFIRM","tags":[],"title":"CVE-2022-41316 HashiCorp Vault Vulnerability in NetApp Products | NetApp Product Security","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://discuss.hashicorp.com","name":"https://discuss.hashicorp.com","refsource":"MISC","tags":[],"title":"HashiCorp Discuss","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-41316","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-41316","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2022","cve_id":"41316","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"hashicorp","cpe5":"vault","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"-","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2022","cve_id":"41316","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"hashicorp","cpe5":"vault","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"enterprise","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[{"cve":"CVE-2022-41316","qid":"502546","title":"Alpine Linux Security Update for vault"},{"cve":"CVE-2022-41316","qid":"502961","title":"Alpine Linux Security Update for vault"},{"cve":"CVE-2022-41316","qid":"505828","title":"Alpine Linux Security Update for vault"}]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2022-41316","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://discuss.hashicorp.com","refsource":"MISC","name":"https://discuss.hashicorp.com"},{"refsource":"MISC","name":"https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first-request/45483","url":"https://discuss.hashicorp.com/t/hcsec-2022-24-vaults-tls-cert-auth-method-only-loaded-crl-after-first-request/45483"},{"refsource":"CONFIRM","name":"https://security.netapp.com/advisory/ntap-20221201-0001/","url":"https://security.netapp.com/advisory/ntap-20221201-0001/"}]}},"nvd":{"publishedDate":"2022-10-12 21:15:00","lastModifiedDate":"2022-12-03 15:02:00","problem_types":["CWE-295"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":3.9,"impactScore":1.4}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*","versionStartIncluding":"1.11.0","versionEndExcluding":"1.11.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"1.11.0","versionEndExcluding":"1.11.4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*","versionStartIncluding":"1.10.0","versionEndExcluding":"1.10.7","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*","versionStartIncluding":"1.10.0","versionEndExcluding":"1.10.7","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*","versionEndExcluding":"1.9.10","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*","versionEndExcluding":"1.9.10","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}