PT-2023-16458 · Hashicorp · Hashicorp Boundary

Published 2023-02-08 · Updated 2024-08-20 · CVE-2023-0690

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Boundary versions 0.10.0 through 0.11.2

Description The issue arises when using a PKI-based worker with a Key Management Service (KMS) defined in the configuration file. After an automatic rotation, new credentials may not be encrypted via the intended KMS, resulting in them being stored in plaintext on the Boundary PKI worker’s disk.

Recommendations For HashiCorp Boundary versions 0.10.0 through 0.11.2, update to version 0.12.0 to resolve the issue. As a temporary workaround, consider restricting access to the credentials stored on the Boundary PKI worker’s disk to minimize the risk of exploitation.

Fix

Cleartext Storage of Sensitive Information

Missing Encryption of Sensitive Data

Weakness Enumeration

CWE-312

CWE-311

Related Identifiers

CVE-2023-0690

GHSA-9VRM-V9XV-X3XR

GO-2023-1898

Affected Products

Hashicorp Boundary

References · 9

• https://osv.dev/vulnerability/GHSA-9vrm-v9xv-x3xr · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2023-03-boundary-workers-store-rotated-credentials-in-plaintext-even-when-key-management-service-configured/49907 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-1898 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-0690 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-0690 · Security Note
• https://github.com/hashicorp/boundary · Note
• https://github.com/advisories/GHSA-9vrm-v9xv-x3xr · Note
• https://t.me/cvenotify/44650 · Telegram Post
• https://t.me/cibsecurity/57795 · Telegram Post