Improper Check or Handling of Exceptional Conditions

Summary

Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, "proxy_protocol_behavior", was set to "deny_unauthorized". When receiving a request from a source IP address that was not listed in "proxy_protocol_authorized_addrs", the Vault API server would shut down and no longer respond to any HTTP requests, potentially resulting in Denial Of Service (DOS). This issue affects github.com/hashicorp/vault versions 1.10.0-rc1 through 1.15.11, 1.16.0-rc1 through 1.16.5, and 1.17.0-rc1 through 1.17.1, a separate regression in those release series did not allow Vault operators to configure the "deny_unauthorized" option, thus not allowing the conditions for the Denial Of Service (DOS) to occur.