CVE-2023-43637

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be "arfoobarfoobarfo".

This issue happens because "deriveVaultKey" calls "retrieveCloudKey" (which will always return "foobarfoobarfoobarfoobarfoobarfo" as the key), and then merges the 32byte randomly generated key with this key (by takeing 16bytes from each, see "mergeKeys").

This makes the key a lot weaker.

This issue does not persist in devices that were initialized on/after version 7.10, but devices that were initialized before that and updated to a newer version still have this issue.

Roll an update that enforces the full 32bytes key usage.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-321 CWE-798

Affected software

No affected versions have been published.

Timeline

Published: Sep 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-43644.3Inappropriate implementation in Permission Prompts in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security U CVE-2023-436406.5TaxonWorks is a web-based workbench designed for taxonomists and biodiversity scientists. Prior to version 0.34.0, a SQL injection vulnerabi CVE-2023-436418.8libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are vulnerable to out-of-bounds array acces CVE-2023-436427.5snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. The SnappyInputStream was found to be vuln CVE-2023-436436.1AntiSamy is a library for performing fast, configurable cleansing of HTML coming from untrusted sources. Prior to version 1.7.4, there is a CVE-2023-436449.8Sing-box is an open source proxy system. Affected versions are subject to an authentication bypass when specially crafted requests are sent CVE-2023-436455.9OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA is vulnerable to a denial of ser CVE-2023-436467.5get-func-name is a module to retrieve a function's name securely and consistently both in NodeJS and the browser. Versions prior to 2.0.1 ar CVE-2023-436475.4baserCMS is a website development framework. Prior to version 4.8.0, there is a cross-site scripting vulnerability in the file upload featur CVE-2023-436486.5baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission dat CVE-2023-436499.8baserCMS is a website development framework. Prior to version 4.8.0, there is a cross site request forgery vulnerability in the content prev CVE-2023-43654.3Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a