CVE-2023-4680 - Vulnerability Details

Vendors	Products
Hashicorp	Vault Vault Enterprise

Link	Providers
https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249
https://github.com/advisories/GHSA-v84f-6r39-cpfc
https://nvd.nist.gov/vuln/detail/CVE-2023-4680
https://www.cve.org/CVERecord?id=CVE-2023-4680

Type	Values Removed	Values Added
Weaknesses		CWE-323

Type	Values Removed	Values Added
First Time appeared		Hashicorp vault Enterprise
CPEs		cpe:2.3:a:hashicorp:vault_enterprise::::::::
Vendors & Products		Hashicorp vault Enterprise
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
References		https://github.com/advisories/GHSA-v84f-6r39-cpfc https://nvd.nist.gov/vuln/detail/CVE-2023-4680 https://www.cve.org/CVERecord?id=CVE-2023-4680
Metrics	threat_severity `None`	threat_severity `Moderate`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-4680", "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "state": "PUBLISHED", "assignerShortName": "HashiCorp", "dateReserved": "2023-08-31T15:50:09.764Z", "datePublished": "2023-09-14T23:06:24.546Z", "dateUpdated": "2024-09-26T17:38:48.629Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "product": "Vault", "repo": "https://github.com/hashicorp/vault", "vendor": "HashiCorp", "versions": [{"lessThan": "1.14.3", "status": "affected", "version": "1.14.0", "versionType": "semver"}, {"lessThan": "1.13.7", "status": "affected", "version": "1.13.0", "versionType": "semver"}, {"lessThan": "1.12.11", "status": "affected", "version": "1.12.0", "versionType": "semver"}, {"lessThan": "1.12.0", "status": "affected", "version": "1.6.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "product": "Vault Enterprise", "repo": "https://github.com/hashicorp/vault", "vendor": "HashiCorp", "versions": [{"lessThan": "1.14.3", "status": "affected", "version": "1.14.0", "versionType": "semver"}, {"lessThan": "1.13.7", "status": "affected", "version": "1.13.0", "versionType": "semver"}, {"lessThan": "1.12.11", "status": "affected", "version": "1.12.0", "versionType": "semver"}, {"lessThan": "1.12.0", "status": "affected", "version": "1.6.0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.</p><br/>"}], "value": "HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11."}], "impacts": [{"capecId": "CAPEC-220", "descriptions": [{"lang": "en", "value": "CAPEC-220: Cryptanalysis"}]}], "metrics": [{"cvssV3_1": {"baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-323", "description": "CWE-323: Reusing a Nonce, Key Pair in Encryption", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "shortName": "HashiCorp", "dateUpdated": "2024-09-26T17:38:48.629Z"}, "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249"}], "source": {"advisory": "HCSEC-2023-28", "discovery": "EXTERNAL"}, "title": "Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption"}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:31:06.556Z"}, "title": "CVE Program Container", "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249", "tags": ["x_transferred"]}]}, {"affected": [{"vendor": "hashicorp", "product": "vault", "cpes": ["cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.14.0", "status": "affected", "lessThan": "1.14.3", "versionType": "custom"}, {"version": "1.13.0", "status": "affected", "lessThan": "1.13.7", "versionType": "custom"}, {"version": "1.12.0", "status": "affected", "lessThan": "1.12.11", "versionType": "custom"}, {"version": "1.6.0", "status": "affected", "lessThan": "1.12.0", "versionType": "custom"}]}, {"vendor": "hashicorp", "product": "vault_enterprise", "cpes": ["cpe:2.3:a:hashicorp:vault_enterprise:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "1.14.0", "status": "affected", "lessThan": "1.14.3", "versionType": "custom"}, {"version": "1.13.0", "status": "affected", "lessThan": "1.13.7", "versionType": "custom"}, {"version": "1.12.0", "status": "affected", "lessThan": "1.12.11", "versionType": "custom"}, {"version": "1.6.0", "status": "affected", "lessThan": "1.12.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-25T19:52:32.242060Z", "id": "CVE-2023-4680", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-25T19:58:36.730Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2023-4680 (string)

assignerOrgId : 67fedba0-ff2e-4543-ba5b-aa93e87718cc (string)

state : PUBLISHED (string)

assignerShortName : HashiCorp (string)

dateReserved : 2023-08-31T15:50:09.764Z (string)

datePublished : 2023-09-14T23:06:24.546Z (string)

dateUpdated : 2024-09-26T17:38:48.629Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

platforms : [ »

0 : 64 bit (string)

1 : 32 bit (string)

2 : x86 (string)

3 : ARM (string)

4 : MacOS (string)

5 : Windows (string)

6 : Linux (string)

]

product : Vault (string)

repo : https://github.com/hashicorp/vault (string)

vendor : HashiCorp (string)

versions : [ »

0 : { »

lessThan : 1.14.3 (string)

status : affected (string)

version : 1.14.0 (string)

versionType : semver (string)

}

1 : { »

lessThan : 1.13.7 (string)

status : affected (string)

version : 1.13.0 (string)

versionType : semver (string)

}

2 : { »

lessThan : 1.12.11 (string)

status : affected (string)

version : 1.12.0 (string)

versionType : semver (string)

}

3 : { »

lessThan : 1.12.0 (string)

status : affected (string)

version : 1.6.0 (string)

versionType : semver (string)

}

]

}

1 : { »

defaultStatus : unaffected (string)

platforms : [ »

0 : 64 bit (string)

1 : 32 bit (string)

2 : x86 (string)

3 : ARM (string)

4 : MacOS (string)

5 : Windows (string)

6 : Linux (string)

]

product : Vault Enterprise (string)

repo : https://github.com/hashicorp/vault (string)

vendor : HashiCorp (string)

versions : [ »

0 : { »

lessThan : 1.14.3 (string)

status : affected (string)

version : 1.14.0 (string)

versionType : semver (string)

}

1 : { »

lessThan : 1.13.7 (string)

status : affected (string)

version : 1.13.0 (string)

versionType : semver (string)

}

2 : { »

lessThan : 1.12.11 (string)

status : affected (string)

version : 1.12.0 (string)

versionType : semver (string)

}

3 : { »

lessThan : 1.12.0 (string)

status : affected (string)

version : 1.6.0 (string)

versionType : semver (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11. (string)

}

]

value : HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-220 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-220: Cryptanalysis (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

baseScore : 6.8 (number)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-323 (string)

description : CWE-323: Reusing a Nonce, Key Pair in Encryption (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 67fedba0-ff2e-4543-ba5b-aa93e87718cc (string)

shortName : HashiCorp (string)

dateUpdated : 2024-09-26T17:38:48.629Z (string)

}

references : [ »

0 : { »

url : https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249 (string)

}

]

source : { »

advisory : HCSEC-2023-28 (string)

discovery : EXTERNAL (string)

}

title : Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T07:31:06.556Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

affected : [ »

0 : { »

vendor : hashicorp (string)

product : vault (string)

cpes : [ »

0 : cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 1.14.0 (string)

status : affected (string)

lessThan : 1.14.3 (string)

versionType : custom (string)

}

1 : { »

version : 1.13.0 (string)

status : affected (string)

lessThan : 1.13.7 (string)

versionType : custom (string)

}

2 : { »

version : 1.12.0 (string)

status : affected (string)

lessThan : 1.12.11 (string)

versionType : custom (string)

}

3 : { »

version : 1.6.0 (string)

status : affected (string)

lessThan : 1.12.0 (string)

versionType : custom (string)

}

]

}

1 : { »

vendor : hashicorp (string)

product : vault_enterprise (string)

cpes : [ »

0 : cpe:2.3:a:hashicorp:vault_enterprise:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unknown (string)

versions : [ »

0 : { »

version : 1.14.0 (string)

status : affected (string)

lessThan : 1.14.3 (string)

versionType : custom (string)

}

1 : { »

version : 1.13.0 (string)

status : affected (string)

lessThan : 1.13.7 (string)

versionType : custom (string)

}

2 : { »

version : 1.12.0 (string)

status : affected (string)

lessThan : 1.12.11 (string)

versionType : custom (string)

}

3 : { »

version : 1.6.0 (string)

status : affected (string)

lessThan : 1.12.0 (string)

versionType : custom (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-09-25T19:52:32.242060Z (string)

id : CVE-2023-4680 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-25T19:58:36.730Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T07:31:06.556Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-4680", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-09-25T19:52:32.242060Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:*"], "vendor": "hashicorp", "product": "vault", "versions": [{"status": "affected", "version": "1.14.0", "lessThan": "1.14.3", "versionType": "custom"}, {"status": "affected", "version": "1.13.0", "lessThan": "1.13.7", "versionType": "custom"}, {"status": "affected", "version": "1.12.0", "lessThan": "1.12.11", "versionType": "custom"}, {"status": "affected", "version": "1.6.0", "lessThan": "1.12.0", "versionType": "custom"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:hashicorp:vault_enterprise:*:*:*:*:*:*:*:*"], "vendor": "hashicorp", "product": "vault_enterprise", "versions": [{"status": "affected", "version": "1.14.0", "lessThan": "1.14.3", "versionType": "custom"}, {"status": "affected", "version": "1.13.0", "lessThan": "1.13.7", "versionType": "custom"}, {"status": "affected", "version": "1.12.0", "lessThan": "1.12.11", "versionType": "custom"}, {"status": "affected", "version": "1.6.0", "lessThan": "1.12.0", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-25T19:58:23.754Z"}}], "cna": {"title": "Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption", "source": {"advisory": "HCSEC-2024-28", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-220", "descriptions": [{"lang": "en", "value": "CAPEC-220: Cryptanalysis"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 6.8, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/hashicorp/vault", "vendor": "HashiCorp", "product": "Vault", "versions": [{"status": "affected", "version": "1.14.0", "lessThan": "1.14.3", "versionType": "semver"}, {"status": "affected", "version": "1.13.0", "lessThan": "1.13.7", "versionType": "semver"}, {"status": "affected", "version": "1.12.0", "lessThan": "1.12.11", "versionType": "semver"}, {"status": "affected", "version": "1.6.0", "lessThan": "1.12.0", "versionType": "semver"}], "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "defaultStatus": "unaffected"}, {"repo": "https://github.com/hashicorp/vault", "vendor": "HashiCorp", "product": "Vault Enterprise", "versions": [{"status": "affected", "version": "1.14.0", "lessThan": "1.14.3", "versionType": "semver"}, {"status": "affected", "version": "1.13.0", "lessThan": "1.13.7", "versionType": "semver"}, {"status": "affected", "version": "1.12.0", "lessThan": "1.12.11", "versionType": "semver"}, {"status": "affected", "version": "1.6.0", "lessThan": "1.12.0", "versionType": "semver"}], "platforms": ["64 bit", "32 bit", "x86", "ARM", "MacOS", "Windows", "Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249"}], "descriptions": [{"lang": "en", "value": "HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.", "supportingMedia": [{"type": "text/html", "value": "<p>HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.</p><br/>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-323", "description": "CWE-323: Reusing a Nonce, Key Pair in Encryption"}]}], "providerMetadata": {"orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "shortName": "HashiCorp", "dateUpdated": "2024-09-26T16:53:53.489Z"}}}, "cveMetadata": {"cveId": "CVE-2023-4680", "state": "PUBLISHED", "dateUpdated": "2024-09-26T16:53:53.489Z", "dateReserved": "2023-08-31T15:50:09.764Z", "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc", "datePublished": "2023-09-14T23:06:24.546Z", "assignerShortName": "HashiCorp"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-02T07:31:06.556Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2023-4680 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-09-25T19:52:32.242060Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:* (string)

]

vendor : hashicorp (string)

product : vault (string)

versions : [ »

0 : { »

status : affected (string)

version : 1.14.0 (string)

lessThan : 1.14.3 (string)

versionType : custom (string)

}

1 : { »

status : affected (string)

version : 1.13.0 (string)

lessThan : 1.13.7 (string)

versionType : custom (string)

}

2 : { »

status : affected (string)

version : 1.12.0 (string)

lessThan : 1.12.11 (string)

versionType : custom (string)

}

3 : { »

status : affected (string)

version : 1.6.0 (string)

lessThan : 1.12.0 (string)

versionType : custom (string)

}

]

defaultStatus : unknown (string)

}

1 : { »

cpes : [ »

0 : cpe:2.3:a:hashicorp:vault_enterprise:*:*:*:*:*:*:*:* (string)

]

vendor : hashicorp (string)

product : vault_enterprise (string)

versions : [ »

0 : { »

status : affected (string)

version : 1.14.0 (string)

lessThan : 1.14.3 (string)

versionType : custom (string)

}

1 : { »

status : affected (string)

version : 1.13.0 (string)

lessThan : 1.13.7 (string)

versionType : custom (string)

}

2 : { »

status : affected (string)

version : 1.12.0 (string)

lessThan : 1.12.11 (string)

versionType : custom (string)

}

3 : { »

status : affected (string)

version : 1.6.0 (string)

lessThan : 1.12.0 (string)

versionType : custom (string)

}

]

defaultStatus : unknown (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-25T19:58:23.754Z (string)

}

]

cna : { »

title : Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption (string)

source : { »

advisory : HCSEC-2024-28 (string)

discovery : EXTERNAL (string)

}

impacts : [ »

0 : { »

capecId : CAPEC-220 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-220: Cryptanalysis (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

version : 3.1 (string)

baseScore : 6.8 (number)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

repo : https://github.com/hashicorp/vault (string)

vendor : HashiCorp (string)

product : Vault (string)

versions : [ »

0 : { »

status : affected (string)

version : 1.14.0 (string)

lessThan : 1.14.3 (string)

versionType : semver (string)

}

1 : { »

status : affected (string)

version : 1.13.0 (string)

lessThan : 1.13.7 (string)

versionType : semver (string)

}

2 : { »

status : affected (string)

version : 1.12.0 (string)

lessThan : 1.12.11 (string)

versionType : semver (string)

}

3 : { »

status : affected (string)

version : 1.6.0 (string)

lessThan : 1.12.0 (string)

versionType : semver (string)

}

]

platforms : [ »

0 : 64 bit (string)

1 : 32 bit (string)

2 : x86 (string)

3 : ARM (string)

4 : MacOS (string)

5 : Windows (string)

6 : Linux (string)

]

defaultStatus : unaffected (string)

}

1 : { »

repo : https://github.com/hashicorp/vault (string)

vendor : HashiCorp (string)

product : Vault Enterprise (string)

versions : [ »

0 : { »

status : affected (string)

version : 1.14.0 (string)

lessThan : 1.14.3 (string)

versionType : semver (string)

}

1 : { »

status : affected (string)

version : 1.13.0 (string)

lessThan : 1.13.7 (string)

versionType : semver (string)

}

2 : { »

status : affected (string)

version : 1.12.0 (string)

lessThan : 1.12.11 (string)

versionType : semver (string)

}

3 : { »

status : affected (string)

version : 1.6.0 (string)

lessThan : 1.12.0 (string)

versionType : semver (string)

}

]

platforms : [ »

0 : 64 bit (string)

1 : 32 bit (string)

2 : x86 (string)

3 : ARM (string)

4 : MacOS (string)

5 : Windows (string)

6 : Linux (string)

]

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-323 (string)

description : CWE-323: Reusing a Nonce, Key Pair in Encryption (string)

}

]

}

]

providerMetadata : { »

orgId : 67fedba0-ff2e-4543-ba5b-aa93e87718cc (string)

shortName : HashiCorp (string)

dateUpdated : 2024-09-26T16:53:53.489Z (string)

}

cveMetadata : { »

cveId : CVE-2023-4680 (string)

state : PUBLISHED (string)

dateUpdated : 2024-09-26T16:53:53.489Z (string)

dateReserved : 2023-08-31T15:50:09.764Z (string)

assignerOrgId : 67fedba0-ff2e-4543-ba5b-aa93e87718cc (string)

datePublished : 2023-09-14T23:06:24.546Z (string)

assignerShortName : HashiCorp (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:*", "matchCriteriaId": "88214AA6-BE16-44D0-8BF3-961AA4F4912C", "versionEndExcluding": "1.12.11", "versionStartIncluding": "1.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "308AEF45-E549-4EA3-8028-3A95978BF44C", "versionEndExcluding": "1.12.11", "versionStartIncluding": "1.6.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:*", "matchCriteriaId": "1190B84C-4AE0-4353-A7B3-64B646E4BCA5", "versionEndExcluding": "1.13.7", "versionStartIncluding": "1.13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "148E1E7C-5DB9-4261-BF3B-A54C8B5F43EA", "versionEndExcluding": "1.13.7", "versionStartIncluding": "1.13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:*", "matchCriteriaId": "931AAAF6-4AB0-46EB-A03F-FF98A22867C2", "versionEndExcluding": "1.14.3", "versionStartIncluding": "1.14.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "778CBB0C-2739-4733-871A-9B053843FADC", "versionEndExcluding": "1.14.3", "versionStartIncluding": "1.14.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11."}, {"lang": "es", "value": "El motor de secretos de tr\u00e1nsito de HashiCorp Vault y Vault Enterprise permiti\u00f3 a los usuarios autorizados especificar nonces arbitrarios, incluso con el cifrado convergente deshabilitado. El endpoint de cifrado, en combinaci\u00f3n con un ataque fuera de l\u00ednea, podr\u00eda usarse para descifrar texto cifrado arbitrario y potencialmente derivar la subclave de autenticaci\u00f3n cuando se utiliza el motor de secretos de tr\u00e1nsito sin cifrado convergente. Introducido en 1.6.0 y corregido en 1.14.3, 1.13.7 y 1.12.11."}], "id": "CVE-2023-4680", "lastModified": "2024-11-21T08:35:40.467", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "security@hashicorp.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-09-15T00:15:07.967", "references": [{"source": "security@hashicorp.com", "tags": ["Vendor Advisory"], "url": "https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249"}], "sourceIdentifier": "security@hashicorp.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-323"}], "source": "security@hashicorp.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 88214AA6-BE16-44D0-8BF3-961AA4F4912C (string)

versionEndExcluding : 1.12.11 (string)

versionStartIncluding : 1.6.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : 308AEF45-E549-4EA3-8028-3A95978BF44C (string)

versionEndExcluding : 1.12.11 (string)

versionStartIncluding : 1.6.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 1190B84C-4AE0-4353-A7B3-64B646E4BCA5 (string)

versionEndExcluding : 1.13.7 (string)

versionStartIncluding : 1.13.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : 148E1E7C-5DB9-4261-BF3B-A54C8B5F43EA (string)

versionEndExcluding : 1.13.7 (string)

versionStartIncluding : 1.13.0 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:hashicorp:vault:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 931AAAF6-4AB0-46EB-A03F-FF98A22867C2 (string)

versionEndExcluding : 1.14.3 (string)

versionStartIncluding : 1.14.0 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : 778CBB0C-2739-4733-871A-9B053843FADC (string)

versionEndExcluding : 1.14.3 (string)

versionStartIncluding : 1.14.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11. (string)

}

1 : { »

lang : es (string)

value : El motor de secretos de tránsito de HashiCorp Vault y Vault Enterprise permitió a los usuarios autorizados especificar nonces arbitrarios, incluso con el cifrado convergente deshabilitado. El endpoint de cifrado, en combinación con un ataque fuera de línea, podría usarse para descifrar texto cifrado arbitrario y potencialmente derivar la subclave de autenticación cuando se utiliza el motor de secretos de tránsito sin cifrado convergente. Introducido en 1.6.0 y corregido en 1.14.3, 1.13.7 y 1.12.11. (string)

}

]

id : CVE-2023-4680 (string)

lastModified : 2024-11-21T08:35:40.467 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.6 (number)

impactScore : 5.2 (number)

source : security@hashicorp.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.6 (number)

impactScore : 5.2 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2023-09-15T00:15:07.967 (string)

references : [ »

0 : { »

source : security@hashicorp.com (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249 (string)

}

]

sourceIdentifier : security@hashicorp.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-323 (string)

}

]

source : security@hashicorp.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-20 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Show plain JSON

{"bugzilla": {"description": "vault: HashiCorp Vault Improper Input Validation vulnerability in github.com/hashicorp/vault", "id": "2306745", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2306745"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-20", "details": ["HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.", "A flaw was found in HashiCorp Vault and Vault Enterprise, where the transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using the transit secrets engine without convergent encryption."], "name": "CVE-2023-4680", "package_state": [{"cpe": "cpe:/a:redhat:openshift_container_storage:4", "fix_state": "Out of support scope", "package_name": "ocs4/cephcsi-rhel8", "product_name": "Red Hat Openshift Container Storage 4"}, {"cpe": "cpe:/a:redhat:openshift_container_storage:4", "fix_state": "Out of support scope", "package_name": "ocs4/mcg-rhel8-operator", "product_name": "Red Hat Openshift Container Storage 4"}, {"cpe": "cpe:/a:redhat:openshift_container_storage:4", "fix_state": "Out of support scope", "package_name": "ocs4/ocs-must-gather-rhel8", "product_name": "Red Hat Openshift Container Storage 4"}, {"cpe": "cpe:/a:redhat:openshift_container_storage:4", "fix_state": "Out of support scope", "package_name": "ocs4/ocs-rhel8-operator", "product_name": "Red Hat Openshift Container Storage 4"}, {"cpe": "cpe:/a:redhat:openshift_container_storage:4", "fix_state": "Out of support scope", "package_name": "ocs4/rook-ceph-rhel8-operator", "product_name": "Red Hat Openshift Container Storage 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Out of support scope", "package_name": "odf4/cephcsi-rhel9", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Out of support scope", "package_name": "odf4/mcg-cli-rhel9", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Out of support scope", "package_name": "odf4/mcg-rhel9-operator", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Out of support scope", "package_name": "odf4/ocs-metrics-exporter-rhel9", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Out of support scope", "package_name": "odf4/ocs-must-gather-rhel8", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Out of support scope", "package_name": "odf4/ocs-rhel9-operator", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Out of support scope", "package_name": "odf4/odf-cli-rhel9", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Out of support scope", "package_name": "odf4/odf-multicluster-rhel9-operator", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Out of support scope", "package_name": "odf4/odf-rhel8-operator", "product_name": "Red Hat Openshift Data Foundation 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Out of support scope", "package_name": "odf4/rook-ceph-rhel8-operator", "product_name": "Red Hat Openshift Data Foundation 4"}], "public_date": "2023-11-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-4680\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-4680\nhttps://discuss.hashicorp.com/t/hcsec-2023-28-vault-s-transit-secrets-engine-allowed-nonce-specified-without-convergent-encryption/58249\nhttps://github.com/advisories/GHSA-v84f-6r39-cpfc"], "threat_severity": "Moderate"}

{

bugzilla : { »

description : vault: HashiCorp Vault Improper Input Validation vulnerability in github.com/hashicorp/vault (string)

id : 2306745 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2306745 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 6.8 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N (string)

status : draft (string)

}

cwe : CWE-20 (string)

details : [ »

0 : HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11. (string)

1 : A flaw was found in HashiCorp Vault and Vault Enterprise, where the transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using the transit secrets engine without convergent encryption. (string)

]

name : CVE-2023-4680 (string)

package_state : [ »

0 : { »

cpe : cpe:/a:redhat:openshift_container_storage:4 (string)