2.5
Faible
CVE-2023-2197 HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction…
Description
HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher text in order to derive Vault’s root key. Fixed in 1.13.2
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Vault Enterprise 1.13 | 1.13.0 → 1.13.1 | Pas de correctif indiqué |
Autres CVE de Vault Enterprise
Les 49 CVE de Vault Enterprise →
CVE-2026-89322
Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and…
7.2
Élevée
CVE-2026-105820
Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs
5.4
Moyenne
CVE-2026-105816
Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within…
8.0
Élevée
CVE-2026-105818
Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when…
5.9
Moyenne