What is CVE-2023-2197?

CVE-2023-2197 is a low-severity vulnerability in Hashicorp Vault, classified under Inadequate Encryption Strength. CVSS score: 2.5/10. Published 2023-05-01.

How severe is CVE-2023-2197?

Low severity. CVSS v3 base score is 2.5 out of 10.

Vulnerability in Hashicorp Vault

CVE-2023-2197

HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher text in order to derive Vault’s root key. Fixed in 1.13.2

EPSS: 0.001 (0.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 2.5 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:N/A:N.

Affected products

Hashicorp Vault
Hashicorp Vault Enterprise — versions 1.13.0

Weakness classification (CWE)

CWE-326 — Inadequate Encryption Strength

References

security@hashicorp.com (Mitigation, Vendor Advisory)
security@hashicorp.com

Frequently asked questions

What is CVE-2023-2197?: CVE-2023-2197 is a low-severity vulnerability in Hashicorp Vault, classified under Inadequate Encryption Strength. CVSS score: 2.5/10. Published 2023-05-01.
How severe is CVE-2023-2197?: Low severity. CVSS v3 base score is 2.5 out of 10.