CVE-2023-4680 — Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption

Description (CNA)

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.

Affected (CNA)

Vendor / product	Versions
HashiCorp / Vault	affected 1.14.0 before 1.14.3; affected 1.13.0 before 1.13.7; affected 1.12.0 before 1.12.11; affected 1.6.0 before 1.12.0
HashiCorp / Vault Enterprise	affected 1.14.0 before 1.14.3; affected 1.13.0 before 1.13.7; affected 1.12.0 before 1.12.11; affected 1.6.0 before 1.12.0

CWE

CWE-323

References

https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249

ADP enrichment

CVE

No English description supplied.

https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249

CISA-ADP

No English description supplied.

No references supplied.