GitHub Advisoryadvisory · Go

GHSA-g7vp-j25f-h34p EVE Has Partially Predetermined Vault Key

MEDIUM Published 2026-02-04 Modified 2026-02-04 Official page ↗
Aliases
CVE-2023-43637
Ecosystem
Go
Packages
github.com/lf-edge/eve
Severity
Moderate
CVSS vector
CVSS:3.1/AV:P/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Weaknesses
CWE-321, CWE-798
Reviewed
2026-02-04

Affected packages

• Go github.com/lf-edge/eve: < 0.0.0-20220310190112-c0c966dc31e2 → fixed in 0.0.0-20220310190112-c0c966dc31e2

Description

Impact The deriveVaultKey function calls retrieveCloudKey which always returns "foobarfoobarfoobarfoobarfoobarfo". When merged with the randomly generated 32-byte key using mergeKeys (16 bytes from each), the last 16 bytes are always "arfoobarfoobarfo". This enables an attacker with physical access to the EVE-OS device to attempt to brute force the remaining 128 bits of key. Patches Fixed in 7.10 and 8.12.1-lts Workarounds None

Related

Alias · CVE (1)

  • CVE-2023-43637 Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes… vulnerability

Weakness · CWE (2)

  • CWE-321 Use of Hard-coded Cryptographic Key weakness
  • CWE-798 Use of Hard-coded Credentials weakness

References