VDB
CVE-2023-25000
CVE-2023-25000
PUBLISHED
CVSS 4.699999809265137 MEDIUM
HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.
EPSS 0.21% · 10.1th percentile
Risk Scores
CVSS 3.1
4.699999809265137
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score
0.21%
10.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | vault | 0, 1.12.0, 1.13.0 |
| Bitnami | vault | 1.13.0, 1.12.0, 0 |
Timeline
- Mar 29, 2023 CVE Published
- Mar 30, 2023 EPSS Score
- May 7, 2023 EPSS Score
- Jun 15, 2023 EPSS Score
- Jul 23, 2023 EPSS Score
- Aug 31, 2023 EPSS Score
- Oct 8, 2023 EPSS Score
- Nov 16, 2023 EPSS Score
- Dec 24, 2023 EPSS Score
- Feb 1, 2024 EPSS Score
- Mar 10, 2024 EPSS Score
- Apr 17, 2024 EPSS Score