Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption
Published Sep 14, 2023
6.8
MEDIUMCVSS 3.1
EPSS 0.44%
Description
HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.
Affected products
-
- Version 1.12.0StatusaffectedConstraints<1.12.11
- Version 1.13.0StatusaffectedConstraints<1.13.7
- Version 1.14.0StatusaffectedConstraints<1.14.3
- Version 1.6.0StatusaffectedConstraints<1.12.0
- Version
-
- Version 1.12.0StatusaffectedConstraints<1.12.11
- Version 1.13.0StatusaffectedConstraints<1.13.7
- Version 1.14.0StatusaffectedConstraints<1.14.3
- Version 1.6.0StatusaffectedConstraints<1.12.0
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| HashiCorp | Vault | unaffected |
| |||||||||||||||
| HashiCorp | Vault Enterprise | unaffected |
|
-
- Version 1.12.0StatusaffectedConstraints<1.12.11
- Version 1.13.0StatusaffectedConstraints<1.13.7
- Version 1.14.0StatusaffectedConstraints<1.14.3
- Version 1.6.0StatusaffectedConstraints<1.12.0
- Version
-
- Version 1.12.0StatusaffectedConstraints<1.12.11
- Version 1.13.0StatusaffectedConstraints<1.13.7
- Version 1.14.0StatusaffectedConstraints<1.14.3
- Version 1.6.0StatusaffectedConstraints<1.12.0
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| HashiCorp | Vault | n/a |
| |||||||||||||||
| HashiCorp | Vault Enterprise | n/a |
|
Red Hat Openshift Container Storage 4
ocs4/cephcsi-rhel8
Out of support scope
Red Hat Openshift Container Storage 4
ocs4/mcg-rhel8-operator
Out of support scope
Red Hat Openshift Container Storage 4
ocs4/ocs-must-gather-rhel8
Out of support scope
Red Hat Openshift Container Storage 4
ocs4/ocs-rhel8-operator
Out of support scope
Red Hat Openshift Container Storage 4
ocs4/rook-ceph-rhel8-operator
Out of support scope
Red Hat Openshift Data Foundation 4
odf4/cephcsi-rhel9
Out of support scope
Red Hat Openshift Data Foundation 4
odf4/mcg-cli-rhel9
Out of support scope
Red Hat Openshift Data Foundation 4
odf4/mcg-rhel8-operator
Out of support scope
Red Hat Openshift Data Foundation 4
odf4/ocs-metrics-exporter-rhel9
Out of support scope
Red Hat Openshift Data Foundation 4
odf4/ocs-must-gather-rhel8
Out of support scope
Red Hat Openshift Data Foundation 4
odf4/ocs-rhel8-operator
Out of support scope
Red Hat Openshift Data Foundation 4
odf4/odf-cli-rhel9
Out of support scope
Red Hat Openshift Data Foundation 4
odf4/odf-multicluster-rhel9-operator
Out of support scope
Red Hat Openshift Data Foundation 4
odf4/odf-rhel8-operator
Out of support scope
Red Hat Openshift Data Foundation 4
odf4/rook-ceph-rhel8-operator
Out of support scope
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Openshift Container Storage 4 | ocs4/cephcsi-rhel8 | Out of support scope | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/mcg-rhel8-operator | Out of support scope | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/ocs-must-gather-rhel8 | Out of support scope | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/ocs-rhel8-operator | Out of support scope | n/a |
| Red Hat Openshift Container Storage 4 | ocs4/rook-ceph-rhel8-operator | Out of support scope | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/cephcsi-rhel9 | Out of support scope | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/mcg-cli-rhel9 | Out of support scope | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/mcg-rhel8-operator | Out of support scope | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/ocs-metrics-exporter-rhel9 | Out of support scope | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/ocs-must-gather-rhel8 | Out of support scope | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/ocs-rhel8-operator | Out of support scope | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odf-cli-rhel9 | Out of support scope | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odf-multicluster-rhel9-operator | Out of support scope | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/odf-rhel8-operator | Out of support scope | n/a |
| Red Hat Openshift Data Foundation 4 | odf4/rook-ceph-rhel8-operator | Out of support scope | n/a |
github.com/hashicorp/vault
Go
Introduced 1.6.0 Fixed 1.12.11github.com/hashicorp/vault
Go
Introduced 1.13.0 Fixed 1.13.7github.com/hashicorp/vault
Go
Introduced 1.14.0 Fixed 1.14.3
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/hashicorp/vault | 1.6.0 | 1.12.11 |
| Go | github.com/hashicorp/vault | 1.13.0 | 1.13.7 |
| Go | github.com/hashicorp/vault | 1.14.0 | 1.14.3 |
Remediation
No remediation recorded yet.
References (7)
- https://access.redhat.com/security/cve/CVE-2023-4680 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2306745 Issue Tracking
- https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249 Vendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2597 Advisory
- https://github.com/advisories/GHSA-v84f-6r39-cpfc Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-4680
- https://www.cve.org/CVERecord?id=CVE-2023-4680
Change history (0)
No recorded changes yet.