PT-2023-7600 · Hashicorp+2 · Hashicorp Vault+3

Published 2023-11-27 · Updated 2024-08-05 · CVE-2023-6337

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions HashiCorp Vault and Vault Enterprise versions 1.12.0 through 1.15.3 HashiCorp Vault and Vault Enterprise versions 1.13.0 through 1.13.11 HashiCorp Vault and Vault Enterprise versions 1.14.0 through 1.14.7

Description The issue is related to the handling of large unauthenticated and authenticated HTTP requests from a client, which can lead to memory exhaustion of the host. When such requests are made, the software attempts to map them to memory, resulting in the depletion of available memory on the host. This can cause the software to crash, leading to a denial of service.

Recommendations For HashiCorp Vault and Vault Enterprise versions 1.12.0 through 1.15.3, update to version 1.15.4 or newer. For HashiCorp Vault and Vault Enterprise versions 1.13.0 through 1.13.11, update to version 1.13.12 or newer. For HashiCorp Vault and Vault Enterprise versions 1.14.0 through 1.14.7, update to version 1.14.8 or newer.

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

ALT-PU-2024-3459

ALT-PU-2024-3678

ALT-PU-2024-3988

ALT-PU-2024-4187

AZL-34585

BDU:2023-08660

BIT-VAULT-2023-6337

CVE-2023-6337

GHSA-6P62-6CG9-F5F5

GO-2023-2399

Affected Products

Alt Linux

Hashicorp Vault

Red Os

Vault Enterprise

References · 18

• https://discuss.hashicorp.com/t/hcsec-2023-34-vault-vulnerable-to-denial-of-service-through-memory-exhaustion-when-handling-large-http-requests/60741 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6p62-6cg9-f5f5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6337 · Security Note
• https://osv.dev/vulnerability/AZL-34585 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-08660 · Security Note
• https://osv.dev/vulnerability/BIT-vault-2023-6337 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2023-2399 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-6337 · Vendor Advisory
• https://github.com/hashicorp/vault · Note
• https://github.com/hashicorp/vault/pull/24354 · Note
• https://t.me/cvenotify/67232 · Telegram Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-vault-05-08-24 · Note
• https://security.netapp.com/advisory/ntap-20240112-0006 · Note
• https://twitter.com/CVEnew/status/1733236247701635331 · Twitter Post