CVE-2023-25000 Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations

🗓️ 30 Mar 2023 00:17:46Reported by HashiCorpType

Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations. HashiCorp fix in versions 1.13.1, 1.12.5, and 1.11.

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to an Observable Timing Discrepancy in Vault (CVE-2023-25000)	4 Apr 202521:24	–	ibm
BDU FSTEC	The vulnerability of the Shamir’s secret platform implementation for archiving corporate information, HashiCorp Vault and Vault Enterprise, allows a intruder to gain unauthorized access to protected information.	29 May 202500:00	–	bdu_fstec
Chainguard	CVE-2023-25000 vulnerabilities	30 Mar 202301:15	–	cgr
CNNVD	HashiCorp Vault 安全漏洞	30 Mar 202300:00	–	cnnvd
CVE	CVE-2023-25000	30 Mar 202300:17	–	cve
EUVD	EUVD-2023-1119	3 Oct 202520:07	–	euvd
Github Security Blog	HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks	30 Mar 202303:30	–	github
HashiCorp Security Advisories	Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations	30 Mar 202300:02	–	hashicorp
NVD	CVE-2023-25000	30 Mar 202301:15	–	nvd
OSV	BIT-VAULT-2023-25000 Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations	6 Mar 202411:09	–	osv

[
  {
    "vendor": "HashiCorp",
    "product": "Vault",
    "platforms": [
      "Windows",
      "MacOS",
      "Linux",
      "x86",
      "ARM",
      "64 bit",
      "32 bit"
    ],
    "repo": "https://github.com/hashicorp/vault",
    "versions": [
      {
        "status": "affected",
        "version": "1.13.0",
        "lessThan": "1.13.1",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "1.12.0",
        "lessThan": "1.12.5",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "1.11.0",
        "lessThan": "1.11.9",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.11.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "vendor": "HashiCorp",
    "product": "Vault Enterprise",
    "platforms": [
      "Windows",
      "MacOS",
      "Linux",
      "x86",
      "ARM",
      "64 bit",
      "32 bit"
    ],
    "versions": [
      {
        "status": "affected",
        "version": "1.13.0",
        "lessThan": "1.13.1",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "1.12.0",
        "lessThan": "1.12.5",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "1.11.0",
        "lessThan": "1.11.9",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "0",
        "lessThan": "1.11.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
security	www.security.netapp.com/advisory/ntap-20230526-0008/
discuss	www.discuss.hashicorp.com/t/hcsec-2023-10-vault-vulnerable-to-cache-timing-attacks-during-seal-and-unseal-operations/52078

26 May 2023 19:06Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.15

EPSS0.0021

CWE-208