Skip to content
OpenAdvisories
High WID-SEC-2023-0795 3 CVEs

Hashicorp Vault: Mehrere Schwachstellen

Published Mar 29, 2023 · Updated Mar 29, 2023 · de-DE

Vendor: HashiCorp Product: Vault Product: Vault < 1.11.9 Product: Vault < 1.12.5 Product: Vault < 1.13.1

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Hashicorp Vault ausnutzen, um Dateien zu manipulieren, einen Denial of Service Zustand herbeizuführen oder die Kryptographie zu umgehen.

Product

Vault ist ein identitätsbasiertes System zur Verwaltung von Geheimnissen und Verschlüsselung.

Vulnerabilities 3

  • Medium 6.5
    CVE-2023-0620

    Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend

    HashiCorp Vault and Vault Enterprise versions 0.8.0 through 1.13.1 are vulnerable to an SQL injection attack when configuring the Microsoft SQL (MSSQL) Database Storage Backend. When configuring the MSSQL plugin through the local, certain parameters are not s…

    HashiCorp Vault Enterprise Vault k3d Wolfi Go
  • Medium 6.5
    CVE-2023-0665

    Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata

    HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or…

    HashiCorp Vault Enterprise Vault k3d Wolfi Go
  • Medium 5.0
    CVE-2023-25000

    Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations

    HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side chann…

    HashiCorp Vault Enterprise Vault k3d Wolfi Go

Revision history

  1. #1

    Initiale Fassung

References