GitHub Advisoryadvisory · Go

GHSA-v84f-6r39-cpfc HashiCorp Vault Improper Input Validation vulnerability

MEDIUM Published 2023-09-15 Modified 2023-09-15 Official page ↗
Aliases
CVE-2023-4680
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-20, CWE-323
Reviewed
2023-09-15

Affected packages

• Go github.com/hashicorp/vault: >= 1.6.0, < 1.12.11 → fixed in 1.12.11 • Go github.com/hashicorp/vault: >= 1.13.0, < 1.13.7 → fixed in 1.13.7 • Go github.com/hashicorp/vault: >= 1.14.0, < 1.14.3 → fixed in 1.14.3

Description

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.

Related

Alias · CVE (1)

  • CVE-2023-4680 HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-323 Reusing a Nonce, Key Pair in Encryption weakness

References