PT-2023-18357 · Hashicorp · Hashicorp Vault Enterprise

CVE-2023-2197 · Published 2023-05-01 · Updated 2025-01-30

Positive Technologies (AI Summary)

CVSS v3.1

2.5

Low

Base vector

AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions HashiCorp Vault Enterprise versions 1.13.0 through 1.13.1

Description The issue concerns a padding oracle attack when using an HSM in conjunction with the CKM AES CBC PAD or CKM AES CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher text in order to derive Vault’s root key.

Recommendations For HashiCorp Vault Enterprise versions 1.13.0 through 1.13.1, update to version 1.13.2 to resolve the issue. As a temporary workaround, consider restricting access to the HSM and limiting privileges to modify storage and restart Vault until the update is applied.

Exploit

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

BIT-VAULT-2023-2197

CVE-2023-2197

Affected Products

Hashicorp Vault Enterprise

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2197.json · Exploit
• https://osv.dev/vulnerability/CVE-2023-2197 · Vendor Advisory
• https://discuss.hashicorp.com/t/hcsec-2023-14-vault-enterprise-vulnerable-to-padding-oracle-attacks-when-using-a-cbc-based-encryption-mechanism-with-a-hsm/53322 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2197 · Security Note
• https://osv.dev/vulnerability/BIT-vault-2023-2197 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20230609-0007 · Note
• https://t.me/cibsecurity/63145 · Telegram Post
• https://t.me/cvenotify/109186 · Telegram Post