/
DirectorySecurity Advisories
Sign In
Security Advisories

CVE-2023-4680

Published

Last updated

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-4680

CGA ID

CGA-hhgm-mv22-ff57

Severity

Unknown

Description

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.

References

  • https://images.chainguard.dev/security/CGA-hhgm-mv22-ff57

Affected packages


Safe Source for Open Sourceâ„¢
Media KitContact Us
© 2025 Chainguard. All Rights Reserved.
Private PolicyTerms of Use

Products

Chainguard ContainersChainguard LibrariesChainguard VMs