CVE-2023-4680
15.09.2023, 00:15
HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.Enginsight
| Vendor | Product | Version |
|---|---|---|
| hashicorp | vault | 1.6.0 ≤ 𝑥 < 1.12.11 |
| hashicorp | vault | 1.6.0 ≤ 𝑥 < 1.12.11 |
| hashicorp | vault | 1.13.0 ≤ 𝑥 < 1.13.7 |
| hashicorp | vault | 1.13.0 ≤ 𝑥 < 1.13.7 |
| hashicorp | vault | 1.14.0 ≤ 𝑥 < 1.14.3 |
| hashicorp | vault | 1.14.0 ≤ 𝑥 < 1.14.3 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-323 - Reusing a Nonce, Key Pair in EncryptionNonces should be used for the present occasion and only once.
- CWE-20 - Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.