Aller au contenu
en Se connecter
6.8 Moyenne

CVE-2023-4680 HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even…

Description

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.

Produits et versions touchés

Produit Versions touchées Corrigé en
Vault 1.14 1.14.0 → < 1.14.3 1.14.3
Vault 1.13 1.13.0 → < 1.13.7 1.13.7
Vault 1.12 1.12.0 → < 1.12.11 1.12.11
Vault 1.6 1.6.0 → < 1.12.0 1.12.0
Vault Enterprise 1.14 1.14.0 → < 1.14.3 1.14.3
Vault Enterprise 1.13 1.13.0 → < 1.13.7 1.13.7
Vault Enterprise 1.12 1.12.0 → < 1.12.11 1.12.11
Vault Enterprise 1.6 1.6.0 → < 1.12.0 1.12.0
vault_enterprise 1.14 1.14.0 → < 1.14.3 1.14.3
Afficher les 3 autres branches
Produit Versions touchées Corrigé en
vault_enterprise 1.13 1.13.0 → < 1.13.7 1.13.7
vault_enterprise 1.12 1.12.0 → < 1.12.11 1.12.11
vault_enterprise 1.6 1.6.0 → < 1.12.0 1.12.0

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Vault

Les 43 CVE de Vault →
CVE-2026-89322 Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and… 7.2 Élevée CVE-2026-105816 Vault and Vault Enterprise did not consistently verify that stored plugin catalog entries reference binaries within… 8.0 Élevée CVE-2026-105818 Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when… 5.9 Moyenne CVE-2026-5006 A vulnerability was identified in HashiCorp Vault and Vault Enterprise (“Vault”) such that an authenticated attacker may… 6.8 Moyenne
Suivre cette CVE