HashiCorp Vault up to 1.11.8/1.12.4/1.13.0 Secret Sharing timing discrepancy

Summaryinfo

A vulnerability has been found in HashiCorp Vault up to 1.11.8/1.12.4/1.13.0 and classified as problematic. Impacted is an unknown function of the component Secret Sharing. Performing a manipulation results in timing discrepancy. This vulnerability was named CVE-2023-25000. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in HashiCorp Vault up to 1.11.8/1.12.4/1.13.0. It has been classified as problematic. This affects an unknown part of the component Secret Sharing. The manipulation with an unknown input leads to a timing discrepancy vulnerability. CWE is classifying the issue as CWE-208. Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not. This is going to have an impact on confidentiality. The summary by CVE is:

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

The weakness was presented 03/30/2023. The advisory is shared at discuss.hashicorp.com. This vulnerability is uniquely identified as CVE-2023-25000 since 02/01/2023. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 1.11.9, 1.12.5 or 1.13.1 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• HashiCorp

Name

• Vault

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.11.0
• 1.11.1
• 1.11.2
• 1.11.3
• 1.11.4
• 1.11.5
• 1.11.6
• 1.11.7
• 1.11.8
• 1.12
• 1.12.0
• 1.12.1
• 1.12.2
• 1.12.3
• 1.12.4
• 1.13.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion