PT-2023-18357 · Hashicorp · Hashicorp Vault Enterprise

Published 2023-05-01 · Updated 2025-01-30 · CVE-2023-2197

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vault Enterprise versions 1.13.0 through 1.13.1

Description The issue concerns a padding oracle attack when using an HSM in conjunction with the CKM AES CBC PAD or CKM AES CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher text in order to derive Vault’s root key.

Recommendations For HashiCorp Vault Enterprise versions 1.13.0 through 1.13.1, update to version 1.13.2 to resolve the issue. As a temporary workaround, consider restricting access to the HSM and limiting privileges to modify storage and restart Vault until the update is applied.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

BIT-VAULT-2023-2197

CVE-2023-2197

Affected Products

Hashicorp Vault Enterprise

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-2197 · Security Note
• https://discuss.hashicorp.com/t/hcsec-2023-14-vault-enterprise-vulnerable-to-padding-oracle-attacks-when-using-a-cbc-based-encryption-mechanism-with-a-hsm/53322 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2023-2197 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-2197 · Vendor Advisory
• https://t.me/cvenotify/109186 · Telegram Post
• https://security.netapp.com/advisory/ntap-20230609-0007 · Note
• https://t.me/cibsecurity/63145 · Telegram Post