PT-2023-18357 · Hashicorp · Hashicorp Vault Enterprise

CVE-2023-2197 · Publicado 2023-05-01 · Atualizado 2025-01-30

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Baixa

Vetor base

AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vault Enterprise versions 1.13.0 through 1.13.1

Description The issue concerns a padding oracle attack when using an HSM in conjunction with the CKM AES CBC PAD or CKM AES CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher text in order to derive Vault’s root key.

Recommendations For HashiCorp Vault Enterprise versions 1.13.0 through 1.13.1, update to version 1.13.2 to resolve the issue. As a temporary workaround, consider restricting access to the HSM and limiting privileges to modify storage and restart Vault until the update is applied.

Exploit

Correção

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

BIT-VAULT-2023-2197

CVE-2023-2197

Produtos afetados

Hashicorp Vault Enterprise

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2197.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-2197 · Aviso do Fabricante
• https://security.netapp.com/advisory/ntap-20230609-0007 · Nota
• https://t.me/cibsecurity/63145 · Publicação no Telegram
• https://discuss.hashicorp.com/t/hcsec-2023-14-vault-enterprise-vulnerable-to-padding-oracle-attacks-when-using-a-cbc-based-encryption-mechanism-with-a-hsm/53322 · Aviso do Fabricante
• https://t.me/cvenotify/109186 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-2197 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-vault-2023-2197 · Aviso do Fabricante