PatchTheCVEvagrant vulnerabilities and fixes
Recent CVEs affecting vagrant, with upgrade or downgrade steps. 5 tracked.
vagrant has 5 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2023-10-27. Highest priority: CVE-2017-16777 (score 48/100).
- CVE-2023-5834 LOW 3.8 UPGRADE HashiCorp Vagrant's Windows installer targeted a custom location with a non-protected path that could be junct
- CVE-2022-42717 HIGH 7.8 UPGRADE An issue was discovered in Hashicorp Packer before 2.3.1
- CVE-2021-21361 MEDIUM 5.3 UPGRADE The `com.bmuschko:gradle-vagrant-plugin` Gradle plugin contains an information disclosure vulnerability due to
- CVE-2017-16777 HIGH 7.8 DOWNGRADE If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is
- CVE-2017-16001 HIGH 7.8 DOWNGRADE In HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.1, a local attacker or malware can s
FAQ
How do I fix vagrant vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is vagrant being exploited right now?
None of the tracked vagrant CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which vagrant CVE should I patch first?
CVE-2017-16777 currently ranks highest (48/100): If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is .