En resumen
- CVE-2023-4680 es una vulnerabilidad MEDIO (CVSS 6.8) que afecta a github.com/hashicorp/vault, vault (hashicorp).
- Probabilidad de explotación en los próximos 30 días (EPSS): 0.44%, mayor que el 38.2% de las vulnerabilidades.
- Solución: actualizar a 1.13.7, 1.14.3, 1.12.11 o posterior.
| Package | Affected versions | Patched versions |
|---|
| github.com/hashicorp/vault Go | ≥ 1.13.0, < 1.13.7≥ 1.14.0, < 1.14.3≥ 1.6.0, < 1.12.11
| 1.13.71.14.31.12.11
|
| vault | ≥ 1.13.0, < 1.13.7≥ 1.14.0, < 1.14.3≥ 1.6.0, < 1.12.11
| 1.13.71.14.31.12.11
|
Description
HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.
NVD description
HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.
Más vulnerabilidades de github.com/hashicorp/vault
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free