CVE-2023-25000

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

HashiCorp Vault's implementation of Shamir's secret sharing used precomputed table lookups, and was vulnerable to cache-timing attacks. An attacker with access to, and the ability to observe a large number of unseal operations on the host through a side channel may reduce the search space of a brute force effort to recover the Shamir shares. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-208 CWE-203

Affected software

No affected versions have been published.

Timeline

Published: Mar 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-250017.8A maliciously crafted SKP file in Autodesk Navisworks 2023 and 2022 be used to trigger use-after-free vulnerability. Exploitation of this vu CVE-2023-250027.8A maliciously crafted SKP file in Autodesk products is used to trigger use-after-free vulnerability. Exploitation of this vulnerability may CVE-2023-250037.8A maliciously crafted pskernel.dll file in Autodesk AutoCAD 2023 and Maya 2022 may be used to trigger out-of-bound read write / read vulnera CVE-2023-250047.8A maliciously crafted pskernel.dll file in Autodesk products is used to trigger integer overflow vulnerabilities. Exploitation of these vuln CVE-2023-250057.8A maliciously crafted DLL file can be forced to read beyond allocated boundaries in Autodesk InfraWorks 2023, and 2021 when parsing the DLL CVE-2023-250067.8A malicious actor may convince a user to open a malicious USD file that may trigger a use-after-free vulnerability which could result in cod CVE-2023-250077.8A malicious actor may convince a user to open a malicious USD file that may trigger an uninitialized pointer which could result in code exec CVE-2023-250087.8A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds read vulnerability which could result i CVE-2023-250097.8A malicious actor may convince a user to open a malicious USD file that may trigger an out-of-bounds write vulnerability which could result CVE-2023-250107.8A malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code exe CVE-2023-250117.8PC settings tool Ver10.1.26.0 and earlier, PC settings tool Ver11.0.22.0 and earlier allows a attacker to write to the registry as administr CVE-2023-250124.6The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED