Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSM
Published May 1, 2023
2.5
LOWCVSS 3.1
EPSS 0.09%
Description
HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher text in order to derive Vault’s root key. Fixed in 1.13.2
Affected products
-
- Version 1.13.0StatusaffectedConstraints<=1.13.1
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| HashiCorp | Vault Enterprise | unaffected |
|
No data.
Logging Subsystem for Red Hat OpenShift
openshift-logging/logging-loki-rhel9
Not affected
Red Hat OpenShift Container Platform 4
openshift4/ose-installer
Not affected
Red Hat OpenShift Container Platform 4
openshift4/topology-aware-lifecycle-manager-rhel8-operator
Not affected
Red Hat Openshift Container Storage 4
ocs4/cephcsi-rhel8
Not affected
Red Hat Openshift Container Storage 4
ocs4/mcg-rhel8-operator
Not affected
Red Hat Openshift Container Storage 4
ocs4/ocs-rhel8-operator
Not affected
Red Hat Openshift Container Storage 4
ocs4/rook-ceph-rhel8-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/cephcsi-rhel9
Not affected
Red Hat Openshift Data Foundation 4
odf4/mcg-rhel8-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/ocs-rhel8-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/odf-multicluster-rhel9-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/odf-rhel8-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/odr-rhel8-operator
Not affected
Red Hat Openshift Data Foundation 4
odf4/rook-ceph-rhel8-operator
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Logging Subsystem for Red Hat OpenShift | openshift-logging/logging-loki-rhel9 | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/ose-installer | Not affected | n/a |
| Red Hat OpenShift Container Platform 4 | openshift4/topology-aware-lifecycle-manager-rhel8-operator | Not affected | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/cephcsi-rhel8 | Not affected | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/mcg-rhel8-operator | Not affected | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/ocs-rhel8-operator | Not affected | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/rook-ceph-rhel8-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/cephcsi-rhel9 | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/mcg-rhel8-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/ocs-rhel8-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odf-multicluster-rhel9-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odf-rhel8-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odr-rhel8-operator | Not affected | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/rook-ceph-rhel8-operator | Not affected | n/a |
No package ranges for this CVE.
Remediation
Red Hat statement
This CVE affects the HashiCorp Vault Enterprise edition, which is not shipped in Red Hat products.
References (7)
- https://access.redhat.com/security/cve/CVE-2023-2197 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2203783 Issue Tracking
- https://discuss.hashicorp.com/t/hcsec-2023-14-vault-enterprise-vulnerable-to-padding-oracle-attacks-when-using-a-cbc-based-encryption-mechanism-with-a-hsm/53322 MitigationVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-33710 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-2197
- https://security.netapp.com/advisory/ntap-20230609-0007/
- https://www.cve.org/CVERecord?id=CVE-2023-2197
Change history (0)
No recorded changes yet.