CVE-2023-25000
Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations
Summary
Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations
Original description
The description as published by the source.
HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Bitnami
vault
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.11.9"},{"introduced":"1.12.0"},{"fixed":"1.12.5"},{"introduced":"1.13.0"},{"fixed":"1.13.1"}]}]
References
- advisory security.netapp.com
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- web discuss.hashicorp.com