Skip to content
OpenAdvisories
Medium · 5.0 CVE-2023-25000 BIT-vault-2023-25000EUVD-2023-1119GHSA-vq4h-9ghm-qmrrGO-2023-1709

Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations

Published Mar 30, 2023 · Updated Feb 13, 2025 · Assigned by HashiCorp

Vendor: HashiCorp Product: Vault Product: Vault Enterprise Package: github.com/hashicorp/vault Package: k3d Package: k3d-proxy Package: k3d-tools Ecosystem: Go Ecosystem: Wolfi

Description

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

Affected products

VendorProductAffectedFixed
HashiCorp Vault 1.13.0 – < 1.13.1, 1.12.0 – < 1.12.5, 1.11.0 – < 1.11.9, < 1.11.0 1.13.1
HashiCorp Vault Enterprise 1.13.0 – < 1.13.1, 1.12.0 – < 1.12.5, 1.11.0 – < 1.11.9, < 1.11.0 1.13.1

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling k3d +2 5.6.0-r11 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/hashicorp/vault < 1.11.9 1.11.9 GHSA-vq4h-9ghm-qmrr
Go github.com/hashicorp/vault >= 1.12.0, < 1.12.5 1.12.5 GHSA-vq4h-9ghm-qmrr
Go github.com/hashicorp/vault >= 1.13.0, < 1.13.1 1.13.1 GHSA-vq4h-9ghm-qmrr
Go github.com/hashicorp/vault < 1.11.9 · >= 1.12.0, < 1.12.5 · >= 1.13.0, < 1.13.1 1.11.9, 1.12.5, 1.13.1 GO-2023-1709

Advisories 2

References