CVE-2023-4680

6.8MEDIUM

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an

发布于: 9/15/2023更新于: 11/21/2024
在NVD查看在MITRE查看

描述

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.

AI分析AI驱动

受影响产品

hashicorpvault
hashicorpvault
hashicorpvault
hashicorpvault
hashicorpvault
hashicorpvault

参考资料