CVE-2023-25000

CVSS V2 None CVSS V3 None
Description
HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.
Overview
  • CVE ID
  • CVE-2023-25000
  • Assigner
  • security@hashicorp.com
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2023-03-30T01:15:07
  • Last Modified Date
  • 2023-04-06T14:45:40
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:* 1 OR 1.11.9
cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:* 1 OR 1.11.9
cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:* 1 OR 1.12.0 1.12.5
cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:* 1 OR 1.12.0 1.12.5
cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:* 1 OR 1.13.0 1.13.1
cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:* 1 OR 1.13.0 1.13.1
History
Created Old Value New Value Data Type Notes
2023-04-17 03:54:19 Added to TrackCVE
2023-04-17 03:54:20 Weakness Enumeration new