CVE-2023-25000

Katalog CVE

CVSS 4.7 · Medium EPSS 0,21%

Kerentanan Observable Timing Discrepancy pada hashicorp vault. Skor CVSS 3.1 4.7 (Medium) menurut NVD.

Deskripsi (NVD)

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

Rincian

Terbit di NVD

30 Maret 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.7 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-208: Observable Timing Discrepancy
CWE-203: Observable Discrepancy

EPSS (30 hari)

0,21% peluang dieksploitasi; lebih tinggi dari 10,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://discuss.hashicorp.com/t/hcsec-2023-10-vault-vulnerable-to-cache-timing-attacks-during-seal-and-unseal-... issue tracking · patch · advisory vendor
• https://security.netapp.com/advisory/ntap-20230526-0008/