{"id":"CVE-2021-29653","details":"HashiCorp Vault and Vault Enterprise 1.5.1 and newer, under certain circumstances, may exclude revoked but unexpired certificates from the CRL. Fixed in 1.5.8, 1.6.4, and 1.7.1.","aliases":["BIT-vault-2021-29653"],"modified":"2026-07-09T00:13:56.344876Z","published":"2021-04-22T17:15:07.753Z","references":[{"type":"ADVISORY","url":"https://discuss.hashicorp.com/t/hcsec-2021-09-vault-s-pki-engine-crl-may-exclude-revoked-but-unexpired-certificates-after-tidy/23461/2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/hashicorp/vault","events":[{"introduced":"acf61cc20e35dfa8d890ff778ecf26194642f85c"},{"fixed":"2df19e576b337ba7fd6fc03ccde67d3324eef310"},{"introduced":"7ce0bd9691998e0443bc77e98b1e2a4ab1e965d4"},{"fixed":"a10df31ee51d18d8dc4a3eda8b6ffd9097b21ba5"},{"introduced":"4e222b85c40a810b74400ee3c54449479e32bb9f"},{"fixed":"917142287996a005cb1ed9d96d00d06a0590e44e"}],"database_specific":{"source":"CPE_RANGE","cpe":["cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*","cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*"],"extracted_events":[{"introduced":"1.5.1"},{"fixed":"1.5.8"},{"introduced":"1.6.0"},{"fixed":"1.6.4"},{"introduced":"1.7.0"},{"fixed":"1.7.1"}]}}],"versions":["sdk/v0.2.0","api/v1.1.0","v1.7.0","v1.6.3","v1.6.2","v1.5.7","v1.6.1","v1.5.6","v1.6.0","v1.5.5","v1.5.4","v1.5.3","v1.5.2","v1.5.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-29653.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"}]}