Inadequate Encryption Strength

2023-05-1121:11:49

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

hsm

padding oracle

root key

software

0.0004 Low

EPSS

Percentile

9.0%

JSON

vault is vulnerable to Inadequate Encryption Strength. Using a HSM in with the ‘CKM_AES_CBC_PAD’ or ‘CKM_AES_CBC’ encryption results in a padding oracle attack where the attacker could gain access to the vaults root key.

CPENameOperatorVersion
vault:edgeeq1.8.3-r0
vault:edgeeq1.12.3-r1
vault:edgeeq1.12.3-r2
vault:edgeeq1.13.1-r0
vault:edgeeq1.9.1-r0
vault:edgeeq1.3.3-r0
vault:edgeeq1.12.2-r3
vault:edgeeq1.8.1-r0
vault:edgeeq1.11.4-r1
vault:edgeeq1.9.0-r0

Name	Operator	Version
vault:edge	eq	1.8.3-r0
vault:edge	eq	1.12.3-r1
vault:edge	eq	1.12.3-r2
vault:edge	eq	1.13.1-r0
vault:edge	eq	1.9.1-r0
vault:edge	eq	1.3.3-r0
vault:edge	eq	1.12.2-r3
vault:edge	eq	1.8.1-r0
vault:edge	eq	1.11.4-r1
vault:edge	eq	1.9.0-r0

Rows per page:

1-10 of 961

References

discuss.hashicorp.com/t/hcsec-2023-14-vault-enterprise-vulnerable-to-padding-oracle-attacks-when-using-a-cbc-based-encryption-mechanism-with-a-hsm/53322

secdb.alpinelinux.org/edge/community.yaml

secdb.alpinelinux.org/v3.18/community.yaml

security.netapp.com/advisory/ntap-20230609-0007/