CVE-2023-2197

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-2197
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-2197.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-2197
Aliases
Published
2023-05-01T19:41:17.600Z
Modified
2026-07-15T01:49:15.696435586Z
Severity
  • 2.5 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N CVSS Calculator
Summary
Vault Enterprise Vulnerable to Padding Oracle Attacks When Using a CBC-based Encryption Mechanism with a HSM
Details

HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKMAESCBCPAD or CKMAES_CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher text in order to derive Vault’s root key. Fixed in 1.13.2

Database specific 
{
    "cna_assigner": "HashiCorp",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2197.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.13.0"
                },
                {
                    "last_affected": "1.13.1"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-326"
    ]
}
References

Affected packages

Git / github.com/hashicorp/vault

Affected ranges

Type
GIT
Repo
https://github.com/hashicorp/vault
Events
Introduced
a4cf0dc4437de35fce4860857b64569d092a9b5a
Fixed
b9b773f1628260423e6cc9745531fd903cae853f
Database specific 
{
    "cpe": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.13.0"
        },
        {
            "fixed": "1.13.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v1.*
v1.13.0
v1.13.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-2197.json"