PT-2023-9602 · Hashicorp+2 · Hashicorp Vault+3

Rob Zimmerman + 1 · Publicado 2023-09-14 · Atualizado 2024-10-15 · CVE-2023-4680

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vault and Vault Enterprise versions 1.6.0 through 1.12.10 HashiCorp Vault and Vault Enterprise versions 1.13.0 through 1.13.6 HashiCorp Vault and Vault Enterprise versions 1.14.0 through 1.14.2

Description The issue is related to improper input validation in the transit secrets engine of HashiCorp Vault and Vault Enterprise. This allows authorized users to specify arbitrary nonces, even when convergent encryption is disabled. The encrypt endpoint can be used in combination with an offline attack to decrypt arbitrary ciphertext and potentially derive the authentication subkey.

Recommendations For HashiCorp Vault and Vault Enterprise versions 1.6.0 through 1.12.10, update to version 1.12.11. For HashiCorp Vault and Vault Enterprise versions 1.13.0 through 1.13.6, update to version 1.13.7. For HashiCorp Vault and Vault Enterprise versions 1.14.0 through 1.14.2, update to version 1.14.3. As a temporary workaround, consider restricting access to the encrypt endpoint until a patch is available.

Correção

RCE

Enumeração de Fraquezas

CWE-20

CWE-323

Identificadores relacionados

ALT-PU-2024-3459

ALT-PU-2024-3678

ALT-PU-2024-4187

BDU:2024-08718

BIT-VAULT-2023-4680

CVE-2023-4680

GHSA-V84F-6R39-CPFC

GO-2023-2063

Produtos afetados

Alt Linux

Hashicorp Vault

Red Os

Vault Enterprise

Referências · 13

• https://github.com/hashicorp/vault · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-vault-cve-2023-4680 · Nota
• https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249 · Aviso do Fabricante
• https://osv.dev/vulnerability/GO-2023-2063 · Aviso do Fabricante
• https://github.com/advisories/GHSA-v84f-6r39-cpfc · Nota
• https://t.me/cvenotify/96180 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-vault-2023-4680 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1702461089156415497 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-4680 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-4680 · Nota de Segurança
• https://redos.red-soft.ru/support/secure · Nota
• https://bdu.fstec.ru/vul/2024-08718 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-v84f-6r39-cpfc · Aviso do Fabricante