SB2023091506 - Security restrictions bypass in HashiCorp Vault and Vault Enterprise

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023091506

SB2023091506 - Security restrictions bypass in HashiCorp Vault and Vault Enterprise

Published: September 15, 2023

Security Bulletin ID SB2023091506
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Security features bypass (CVE-ID: CVE-2023-4680)

The vulnerability allows a remote user to bypass implemented security restrictions.

The vulnerability exists due to an error when enforcing policies related to convergent encryption feature. Software does not restrict the use of user-provided nonces when performing encryption operations on the transit secrets engine when convergent encryption is not enabled. A remote user authorized by Vault policies to encrypt transit data may be able to decrypt arbitrary ciphertext by performing encryption operations using known plaintexts and nonces.


Remediation

Install update from vendor's website.

References