GO-2023-1709 Cache-timing attacks in Shamir's secret sharing in github.com/hashicorp/vault

🗓️ 12 Apr 2023 17:45:35Reported by GoogleType

osv

osv🔗 osv.dev👁 196 Views

Cache-timing attacks in Shamir's secret sharing in HashiCorp Vault implementation

Reporter	Title	Published	Views	Family All 27
IBM Security Bulletins	Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to an Observable Timing Discrepancy in Vault (CVE-2023-25000)	4 Apr 202521:24	–	ibm
BDU FSTEC	The vulnerability of the Shamir’s secret platform implementation for archiving corporate information, HashiCorp Vault and Vault Enterprise, allows a intruder to gain unauthorized access to protected information.	29 May 202500:00	–	bdu_fstec
Chainguard	CVE-2023-25000 vulnerabilities	30 Mar 202301:15	–	cgr
CNNVD	HashiCorp Vault 安全漏洞	30 Mar 202300:00	–	cnnvd
CVE	CVE-2023-25000	30 Mar 202300:17	–	cve
Cvelist	CVE-2023-25000 Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations	30 Mar 202300:17	–	cvelist
EUVD	EUVD-2023-1119	3 Oct 202520:07	–	euvd
Github Security Blog	HashiCorp Vault's implementation of Shamir's secret sharing vulnerable to cache-timing attacks	30 Mar 202303:30	–	github
NVD	CVE-2023-25000	30 Mar 202301:15	–	nvd
OSV	BIT-VAULT-2023-25000 Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations	6 Mar 202411:09	–	osv

Source	Link
github	www.github.com/hashicorp/vault/pull/19495
discuss	www.discuss.hashicorp.com/t/hcsec-2023-10-vault-vulnerable-to-cache-timing-attacks-during-seal-and-unseal-operations/52078

04 Feb 2026 03:29Current

4.8Medium risk

Vulners AI Score4.8

CVSS 3.14.7 - 5

EPSS0.0021

SSVC

shamir's secret sharing hashicorp vault cache-timing attacks software side channel