PT-2023-26086 · Hashicorp · Vault Enterprise

Published 2023-07-28 · Updated 2024-09-26 · CVE-2023-3774

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Vault Enterprise versions prior to 1.14.1 Vault Enterprise versions prior to 1.13.5 Vault Enterprise versions prior to 1.12.9

Description An unhandled error in Vault Enterprise's namespace creation may cause the Vault process to crash, potentially resulting in denial of service.

Recommendations For versions prior to 1.14.1, update to version 1.14.1 or later. For versions prior to 1.13.5, update to version 1.13.5 or later. For versions prior to 1.12.9, update to version 1.12.9 or later.

Fix

DoS

Improper Handling of Exceptional Conditions

Weakness Enumeration

CWE-248

CWE-755

Related Identifiers

BIT-VAULT-2023-3774

CVE-2023-3774

Affected Products

Vault Enterprise

References · 6

• https://discuss.hashicorp.com/t/hcsec-2023-23-vault-enterprise-namespace-creation-may-lead-to-denial-of-service/56617 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2023-3774 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-3774 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3774 · Security Note
• https://t.me/cvenotify/55383 · Telegram Post
• https://t.me/cvenotify/96255 · Telegram Post