Lucene search

PRIOn knowledge basePRION:CVE-2023-0690

HistoryFeb 08, 2023 - 7:15 p.m.

Design/Logic Flaw

2023-02-0819:15:00

PRIOn knowledge base

www.prio-n.com

hashicorp boundary

pki worker

plaintext storage

automatic rotation

key management service

6.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted via the intended KMS. This would result in the credentials being stored in plaintext on the Boundary PKI worker’s disk. This issue is fixed in version 0.12.0.

CPENameOperatorVersion
boundaryge0.10.0
boundarylt0.12.0

CPE	Name	Operator	Version
	boundary	ge	0.10.0
	boundary	lt	0.12.0

References

discuss.hashicorp.com/t/hcsec-2023-03-boundary-workers-store-rotated-credentials-in-plaintext-even-when-key-management-service-configured/49907