Vulnerability-Lookup

CVE-2023-0665 (GCVE-0-2023-0665)

Vulnerability from cvelistv5 – Published: 2023-03-30 00:21 – Updated: 2025-02-13 16:39

Title

Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata

Summary

HashiCorp Vault's PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-12 15:00 UTC

CWE

CWE-285 - Improper Authorization

Assigner

HashiCorp CNA under the mitre root

CNA scorecard C 70/100 over 49 records in the last 180 days details

References

2 references

URL	Tags
https://discuss.hashicorp.com/t/hcsec-2023-11-vau…
https://security.netapp.com/advisory/ntap-2023052…

Impacted products

2 products

Vendor	Product	Version	CPE status
HashiCorp	Vault	Affected: 1.13.0 , < 1.13.1 (semver) Affected: 1.12.0 , < 1.12.5 (semver) Affected: 1.11.0 , < 1.11.9 (semver)	guessed
HashiCorp	Vault Enterprise	Affected: 1.13.0 , < 1.13.1 (semver) Affected: 1.12.0 , < 1.12.5 (semver) Affected: 1.11.0 , < 1.11.9 (semver)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T05:17:50.328Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20230526-0008/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-0665",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-12T15:00:11.247720Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T15:00:17.817Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux",
            "x86",
            "ARM",
            "64 bit",
            "32 bit"
          ],
          "product": "Vault",
          "repo": "https://github.com/hashicorp/vault",
          "vendor": "HashiCorp",
          "versions": [
            {
              "lessThan": "1.13.1",
              "status": "affected",
              "version": "1.13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.12.5",
              "status": "affected",
              "version": "1.12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.11.9",
              "status": "affected",
              "version": "1.11.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux",
            "x86",
            "ARM",
            "64 bit",
            "32 bit"
          ],
          "product": "Vault Enterprise",
          "vendor": "HashiCorp",
          "versions": [
            {
              "lessThan": "1.13.1",
              "status": "affected",
              "version": "1.13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.12.5",
              "status": "affected",
              "version": "1.12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.11.9",
              "status": "affected",
              "version": "1.11.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "HashiCorp Vault\u0027s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.."
            }
          ],
          "value": "HashiCorp Vault\u0027s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-285",
              "description": "CWE-285 Improper Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-05-26T19:06:23.683Z",
        "orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
        "shortName": "HashiCorp"
      },
      "references": [
        {
          "url": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20230526-0008/"
        }
      ],
      "source": {
        "advisory": "HCSEC-2023-11",
        "discovery": "INTERNAL"
      },
      "title": "Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
    "assignerShortName": "HashiCorp",
    "cveId": "CVE-2023-0665",
    "datePublished": "2023-03-30T00:21:47.676Z",
    "dateReserved": "2023-02-03T21:24:59.629Z",
    "dateUpdated": "2025-02-13T16:39:04.425Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-0665",
      "date": "2026-11-04",
      "epss": "0.00332",
      "percentile": "0.26531"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "platforms": [
                  "Windows",
                  "MacOS",
                  "Linux",
                  "x86",
                  "ARM",
                  "64 bit",
                  "32 bit"
                ],
                "product": "Vault",
                "repo": "https://github.com/hashicorp/vault",
                "vendor": "HashiCorp",
                "versions": [
                  {
                    "lessThan": "1.13.1",
                    "status": "affected",
                    "version": "1.13.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "1.12.5",
                    "status": "affected",
                    "version": "1.12.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "1.11.9",
                    "status": "affected",
                    "version": "1.11.0",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "platforms": [
                  "Windows",
                  "MacOS",
                  "Linux",
                  "x86",
                  "ARM",
                  "64 bit",
                  "32 bit"
                ],
                "product": "Vault Enterprise",
                "vendor": "HashiCorp",
                "versions": [
                  {
                    "lessThan": "1.13.1",
                    "status": "affected",
                    "version": "1.13.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "1.12.5",
                    "status": "affected",
                    "version": "1.12.0",
                    "versionType": "semver"
                  },
                  {
                    "lessThan": "1.11.9",
                    "status": "affected",
                    "version": "1.11.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@hashicorp.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
                    "matchCriteriaId": "2C565DBD-95F4-4951-A029-93ABE5315740",
                    "versionEndExcluding": "1.11.9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "80EB9F32-09A4-469C-AF76-1AE3137EAC1B",
                    "versionEndExcluding": "1.11.9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
                    "matchCriteriaId": "446F872F-F64C-44CA-85BC-144FCFBCFA8B",
                    "versionEndExcluding": "1.12.5",
                    "versionStartIncluding": "1.12.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "71A02FE6-C8D4-455D-A71A-C8353E1ECB7C",
                    "versionEndExcluding": "1.12.5",
                    "versionStartIncluding": "1.12.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
                    "matchCriteriaId": "81280166-3DF7-4867-95E9-A7AFB9A12CE7",
                    "versionEndExcluding": "1.13.1",
                    "versionStartIncluding": "1.13.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
                    "matchCriteriaId": "C56E203C-1E18-4395-B500-B6EA695B16C0",
                    "versionEndExcluding": "1.13.1",
                    "versionStartIncluding": "1.13.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "HashiCorp Vault\u0027s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9."
          }
        ],
        "id": "CVE-2023-0665",
        "lastModified": "2026-06-17T05:26:02.710",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 2.5,
              "source": "security@hashicorp.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 2.5,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2023-0665",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-12T15:00:11.247720Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2023-03-30T01:15:07.437",
        "references": [
          {
            "source": "security@hashicorp.com",
            "tags": [
              "Issue Tracking",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1"
          },
          {
            "source": "security@hashicorp.com",
            "url": "https://security.netapp.com/advisory/ntap-20230526-0008/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Issue Tracking",
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://security.netapp.com/advisory/ntap-20230526-0008/"
          }
        ],
        "sourceIdentifier": "security@hashicorp.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-285"
              }
            ],
            "source": "security@hashicorp.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-Other"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-31T15:21:33+00:00",
      "cve": "CVE-2023-0665",
      "id": "CVE-2023-0665",
      "initial_release_date": "2023-03-30T00:00:00+00:00",
      "product_status:fixed": "15",
      "product_status:known_affected": "7",
      "product_status:known_not_affected": "1309",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "hashicorp/vault: Vault\u2019s PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-0665.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-02T05:17:50.328Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1"
              },
              {
                "tags": [
                  "x_transferred"
                ],
                "url": "https://security.netapp.com/advisory/ntap-20230526-0008/"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2023-0665",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-02-12T15:00:11.247720Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-02-12T14:59:55.969Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "platforms": [
                "Windows",
                "MacOS",
                "Linux",
                "x86",
                "ARM",
                "64 bit",
                "32 bit"
              ],
              "product": "Vault",
              "repo": "https://github.com/hashicorp/vault",
              "vendor": "HashiCorp",
              "versions": [
                {
                  "lessThan": "1.13.1",
                  "status": "affected",
                  "version": "1.13.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "1.12.5",
                  "status": "affected",
                  "version": "1.12.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "1.11.9",
                  "status": "affected",
                  "version": "1.11.0",
                  "versionType": "semver"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "platforms": [
                "Windows",
                "MacOS",
                "Linux",
                "x86",
                "ARM",
                "64 bit",
                "32 bit"
              ],
              "product": "Vault Enterprise",
              "vendor": "HashiCorp",
              "versions": [
                {
                  "lessThan": "1.13.1",
                  "status": "affected",
                  "version": "1.13.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "1.12.5",
                  "status": "affected",
                  "version": "1.12.0",
                  "versionType": "semver"
                },
                {
                  "lessThan": "1.11.9",
                  "status": "affected",
                  "version": "1.11.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "HashiCorp Vault\u0027s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.."
                }
              ],
              "value": "HashiCorp Vault\u0027s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 6.5,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-285",
                  "description": "CWE-285 Improper Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2023-05-26T19:06:23.683Z",
            "orgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
            "shortName": "HashiCorp"
          },
          "references": [
            {
              "url": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1"
            },
            {
              "url": "https://security.netapp.com/advisory/ntap-20230526-0008/"
            }
          ],
          "source": {
            "advisory": "HCSEC-2023-11",
            "discovery": "INTERNAL"
          },
          "title": "Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "67fedba0-ff2e-4543-ba5b-aa93e87718cc",
        "assignerShortName": "HashiCorp",
        "cveId": "CVE-2023-0665",
        "datePublished": "2023-03-30T00:21:47.676Z",
        "dateReserved": "2023-02-03T21:24:59.629Z",
        "dateUpdated": "2025-02-13T16:39:04.425Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2025-06181 (CVE-2023-0665)

Vulnerability from fstec – Published: 2025-05-29 – Updated: 2025-05-29 – View on bdu.fstec.ru Fixed

Title

Уязвимость механизма PKI платформ для архивирования корпоративной информации HashiCorp Vault и Vault Enterprise, позволяющая нарушителю вызвать отказ в обслуживании

Summary

Уязвимость механизма PKI платформ для архивирования корпоративной информации HashiCorp Vault и Vault Enterprise связана с неправильной авторизацией. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, вызвать отказ в обслуживании

Severity

6.4 (Medium) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:N/I:P/A:P

6.5 (Medium) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Authorization bypass

Incidents

Being clarified

Remediation

Software update

CWE

CWE-285 - Неправильная авторизация

Aliases

CVE-2023-0665

References

2 references

URL
https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-n…
https://redos.red-soft.ru/support/secure/

Impacted products

3 products from 2 vendors

Vendors

ООО «Ред Софт», HashiCorp

Products

РЕД ОС (запись в едином реестре российских программ №3751), Vault, Vault Enterprise

Versions

7.3 (РЕД ОС), до 1.11.9 (Vault), до 1.11.9 (Vault Enterprise), до 1.12.5 (Vault), до 1.13.1 (Vault), до 1.13.1 (Vault Enterprise), до 1.12.5 (Vault Enterprise)

Product types

Operating system, Application software

Platforms

ООО «Ред Софт» РЕД ОС 7.3 (запись в едином реестре российских программ №3751)

Mitigations

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года. Использование рекомендаций: Для Vault и Vault Enterprise: https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1 Для РедоС: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
  "CVSS 3.0": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "\u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb, HashiCorp",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "7.3 (\u0420\u0415\u0414 \u041e\u0421), \u0434\u043e 1.11.9 (Vault), \u0434\u043e 1.11.9 (Vault Enterprise), \u0434\u043e 1.12.5 (Vault), \u0434\u043e 1.13.1 (Vault), \u0434\u043e 1.13.1 (Vault Enterprise), \u0434\u043e 1.12.5 (Vault Enterprise)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0412 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043e\u0442 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c\u0441\u044f \"\u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0435 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c LINUX\", \u0438\u0437\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u043c\u0435\u0442\u043e\u0434\u0438\u0447\u0435\u0441\u043a\u043e\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0435 \u0424\u0421\u0422\u042d\u041a \u0420\u043e\u0441\u0441\u0438\u0438, \u0443\u0442\u0432\u0435\u0440\u0436\u0434\u0451\u043d\u043d\u043e\u043c 25 \u0434\u0435\u043a\u0430\u0431\u0440\u044f 2022 \u0433\u043e\u0434\u0430.\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\n\u0414\u043b\u044f Vault \u0438 Vault Enterprise:\nhttps://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1\n\n\u0414\u043b\u044f \u0420\u0435\u0434\u043e\u0421: http://repo.red-soft.ru/redos/7.3c/x86_64/updates/",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "29.03.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "29.05.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "29.05.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-06181",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2023-0665",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "\u0420\u0415\u0414 \u041e\u0421 (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751), Vault, Vault Enterprise",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": "\u041e\u041e\u041e \u00ab\u0420\u0435\u0434 \u0421\u043e\u0444\u0442\u00bb \u0420\u0415\u0414 \u041e\u0421 7.3  (\u0437\u0430\u043f\u0438\u0441\u044c \u0432 \u0435\u0434\u0438\u043d\u043e\u043c \u0440\u0435\u0435\u0441\u0442\u0440\u0435 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c \u21163751)",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 PKI \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 HashiCorp Vault \u0438 Vault Enterprise, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0430\u044f \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u044f (CWE-285)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c\u0430 PKI \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c \u0434\u043b\u044f \u0430\u0440\u0445\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043a\u043e\u0440\u043f\u043e\u0440\u0430\u0442\u0438\u0432\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 HashiCorp Vault \u0438 Vault Enterprise \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0435\u0439. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0430\u0440\u0443\u0448\u0435\u043d\u0438\u0435 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1\nhttps://redos.red-soft.ru/support/secure/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u0430\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u0430, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-285",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,4)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,5)"
}

bit-vault-2023-0665

Vulnerability from bitnami_vulndb

Published

2024-03-06 11:09

Modified

2026-09-08 08:34

Summary

Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata

Details

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "vault",
        "purl": "pkg:bitnami/vault"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.11.9"
            },
            {
              "introduced": "1.12.0"
            },
            {
              "fixed": "1.12.5"
            },
            {
              "introduced": "1.13.0"
            },
            {
              "fixed": "1.13.1"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-0665"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
      "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*"
    ],
    "severity": "Medium"
  },
  "details": "HashiCorp Vault\u0027s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.",
  "id": "BIT-vault-2023-0665",
  "modified": "2026-09-08T08:34:36.952Z",
  "published": "2024-03-06T11:09:34.669Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20230526-0008/"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0665"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata"
}

FKIE_CVE-2023-0665

Vulnerability from fkie_nvd - Published: 2023-03-30 01:15 - Updated: 2026-06-17 05:26

Severity

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Summary

References

URL	Tags
security@hashicorp.com	https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1	Issue Tracking, Patch, Vendor Advisory
security@hashicorp.com	https://security.netapp.com/advisory/ntap-20230526-0008/
af854a3a-2127-422b-91ae-364da2661108	https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1	Issue Tracking, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://security.netapp.com/advisory/ntap-20230526-0008/

Impacted products

Vendor	Product	Version
hashicorp	vault	*
hashicorp	vault	*
hashicorp	vault	*
hashicorp	vault	*
hashicorp	vault	*
hashicorp	vault	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux",
            "x86",
            "ARM",
            "64 bit",
            "32 bit"
          ],
          "product": "Vault",
          "repo": "https://github.com/hashicorp/vault",
          "vendor": "HashiCorp",
          "versions": [
            {
              "lessThan": "1.13.1",
              "status": "affected",
              "version": "1.13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.12.5",
              "status": "affected",
              "version": "1.12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.11.9",
              "status": "affected",
              "version": "1.11.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows",
            "MacOS",
            "Linux",
            "x86",
            "ARM",
            "64 bit",
            "32 bit"
          ],
          "product": "Vault Enterprise",
          "vendor": "HashiCorp",
          "versions": [
            {
              "lessThan": "1.13.1",
              "status": "affected",
              "version": "1.13.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.12.5",
              "status": "affected",
              "version": "1.12.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.11.9",
              "status": "affected",
              "version": "1.11.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "security@hashicorp.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "2C565DBD-95F4-4951-A029-93ABE5315740",
              "versionEndExcluding": "1.11.9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "80EB9F32-09A4-469C-AF76-1AE3137EAC1B",
              "versionEndExcluding": "1.11.9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "446F872F-F64C-44CA-85BC-144FCFBCFA8B",
              "versionEndExcluding": "1.12.5",
              "versionStartIncluding": "1.12.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "71A02FE6-C8D4-455D-A71A-C8353E1ECB7C",
              "versionEndExcluding": "1.12.5",
              "versionStartIncluding": "1.12.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
              "matchCriteriaId": "81280166-3DF7-4867-95E9-A7AFB9A12CE7",
              "versionEndExcluding": "1.13.1",
              "versionStartIncluding": "1.13.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
              "matchCriteriaId": "C56E203C-1E18-4395-B500-B6EA695B16C0",
              "versionEndExcluding": "1.13.1",
              "versionStartIncluding": "1.13.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "HashiCorp Vault\u0027s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9."
    }
  ],
  "id": "CVE-2023-0665",
  "lastModified": "2026-06-17T05:26:02.710",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "security@hashicorp.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-0665",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-02-12T15:00:11.247720Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2023-03-30T01:15:07.437",
  "references": [
    {
      "source": "security@hashicorp.com",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1"
    },
    {
      "source": "security@hashicorp.com",
      "url": "https://security.netapp.com/advisory/ntap-20230526-0008/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://security.netapp.com/advisory/ntap-20230526-0008/"
    }
  ],
  "sourceIdentifier": "security@hashicorp.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ],
      "source": "security@hashicorp.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-HWC3-3QH6-R4GG

Vulnerability from github – Published: 2023-03-30 03:30 – Updated: 2023-04-07 19:22

Summary

HashiCorp Vault's PKI mount vulnerable to denial of service

Details

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hashicorp/vault"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.11.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hashicorp/vault"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.12.0"
            },
            {
              "fixed": "1.12.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/hashicorp/vault"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.13.0"
            },
            {
              "fixed": "1.13.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2023-0665"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-04-07T19:22:54Z",
    "nvd_published_at": "2023-03-30T01:15:00Z",
    "severity": "MODERATE"
  },
  "details": "HashiCorp Vault\u0027s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.",
  "id": "GHSA-hwc3-3qh6-r4gg",
  "modified": "2023-04-07T19:22:54Z",
  "published": "2023-03-30T03:30:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0665"
    },
    {
      "type": "WEB",
      "url": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/hashicorp/vault"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20230526-0008"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "HashiCorp Vault\u0027s PKI mount vulnerable to denial of service"
}

GSD-2023-0665

Vulnerability from gsd - Updated: 2023-12-13 01:20

Details

Aliases

CVE-2023-0665

Aliases

CVE-2023-0665

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2023-0665",
    "id": "GSD-2023-0665"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-0665"
      ],
      "details": "HashiCorp Vault\u0027s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.",
      "id": "GSD-2023-0665",
      "modified": "2023-12-13T01:20:22.373713Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security@hashicorp.com",
        "ID": "CVE-2023-0665",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "Vault",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "1.13.0",
                          "version_value": "1.13.1"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_name": "1.12.0",
                          "version_value": "1.12.5"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_name": "1.11.0",
                          "version_value": "1.11.9"
                        }
                      ]
                    }
                  },
                  {
                    "product_name": "Vault Enterprise",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "\u003c",
                          "version_name": "1.13.0",
                          "version_value": "1.13.1"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_name": "1.12.0",
                          "version_value": "1.12.5"
                        },
                        {
                          "version_affected": "\u003c",
                          "version_name": "1.11.0",
                          "version_value": "1.11.9"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "HashiCorp"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "HashiCorp Vault\u0027s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9."
          }
        ]
      },
      "impact": {
        "cvss": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "cweId": "CWE-285",
                "lang": "eng",
                "value": "CWE-285 Improper Authorization"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1",
            "refsource": "MISC",
            "url": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1"
          },
          {
            "name": "https://security.netapp.com/advisory/ntap-20230526-0008/",
            "refsource": "MISC",
            "url": "https://security.netapp.com/advisory/ntap-20230526-0008/"
          }
        ]
      },
      "source": {
        "advisory": "HCSEC-2023-11",
        "discovery": "INTERNAL"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c1.11.9||\u003e=1.12.0 \u003c1.12.5||\u003e=1.13.0 \u003c1.13.1",
          "affected_versions": "All versions before 1.11.9, all versions starting from 1.12.0 before 1.12.5, all versions starting from 1.13.0 before 1.13.1",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2023-04-07",
          "description": "HashiCorp Vault\u0027s PKI mount issuer endpoints does not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug does not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9.",
          "fixed_versions": [
            "1.11.9",
            "1.12.5",
            "1.13.1"
          ],
          "identifier": "CVE-2023-0665",
          "identifiers": [
            "GHSA-hwc3-3qh6-r4gg",
            "CVE-2023-0665"
          ],
          "not_impacted": "All versions starting from 1.11.9 before 1.12.0, all versions starting from 1.12.5 before 1.13.0, all versions starting from 1.13.1",
          "package_slug": "go/github.com/hashicorp/vault",
          "pubdate": "2023-03-30",
          "solution": "Upgrade to versions 1.11.9, 1.12.5, 1.13.1 or above.",
          "title": "HashiCorp Vault\u0027s PKI mount vulnerable to denial of service",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2023-0665",
            "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1",
            "https://github.com/advisories/GHSA-hwc3-3qh6-r4gg"
          ],
          "uuid": "69af7a37-6cc2-4d81-bd7f-7084902f41ea"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.12.5",
                "versionStartIncluding": "1.12.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.12.5",
                "versionStartIncluding": "1.12.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.11.9",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.11.9",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.13.1",
                "versionStartIncluding": "1.13.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "1.13.1",
                "versionStartIncluding": "1.13.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "security@hashicorp.com",
          "ID": "CVE-2023-0665"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "HashiCorp Vault\u0027s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in denial of service of the PKI mount. This bug did not affect public or private key material, trust chains or certificate issuance. Fixed in Vault 1.13.1, 1.12.5, and 1.11.9."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-Other"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1",
              "refsource": "MISC",
              "tags": [
                "Issue Tracking",
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://discuss.hashicorp.com/t/hcsec-2023-11-vault-s-pki-issuer-endpoint-did-not-correctly-authorize-access-to-issuer-metadata/52079/1"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20230526-0008/",
              "refsource": "MISC",
              "tags": [],
              "url": "https://security.netapp.com/advisory/ntap-20230526-0008/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 2.5
        }
      },
      "lastModifiedDate": "2023-05-26T20:15Z",
      "publishedDate": "2023-03-30T01:15Z"
    }
  }
}

RHSA-2023:1326

Vulnerability from csaf_redhat - Published: 2023-05-17 22:30 - Updated: 2026-11-05 05:46

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.13.0 security update

Severity

Important

Scope

24 vulnerabilities in this advisory, including CVE-2023-0665.

CVE-2023-0665

A flaw was found in the Hashicorp vault. Vault’s PKI mount issuer endpoints did not correctly authorize access to remove an issuer or modify issuer metadata, potentially resulting in a denial of service of the PKI mount. This bug did not affect public or private key material, trust chains, or certificate issuance.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Fixed: 4 products Known not affected: 602 products

https://access.redhat.com/errata/RHSA-2023:1326

Open the full advisory

RHSA-2023:3742

Vulnerability from csaf_redhat - Published: 2023-06-21 15:22 - Updated: 2026-11-05 05:46

Summary

Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.13.0 security and bug fix update

Severity

Important

Scope

33 vulnerabilities in this advisory, including CVE-2023-0665.

CVE-2023-0665

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Fixed: 7 products Known not affected: 76 products

https://access.redhat.com/errata/RHSA-2023:3742

Open the full advisory

RHSA-2023:5006

Vulnerability from csaf_redhat - Published: 2023-10-31 12:54 - Updated: 2026-11-05 05:58

Summary

Red Hat Security Advisory: OpenShift Container Platform 4.14.0 bug fix and security update

Severity

Important

Scope

24 vulnerabilities in this advisory, including CVE-2023-0665.

CVE-2023-0665

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Fixed: 4 products Known not affected: 627 products

https://access.redhat.com/errata/RHSA-2023:5006

Open the full advisory

WID-SEC-W-2023-0795

Vulnerability from csaf_certbund - Published: 2023-03-29 22:00 - Updated: 2023-03-29 22:00

Summary

Hashicorp Vault: Mehrere Schwachstellen

Severity

Hoch

Scope

3 vulnerabilities in this advisory, including CVE-2023-0665.

CVE-2023-0665

Es existiert eine Schwachstelle in Hashicorp Vault. Diese ist auf einen Fehler in der Komponente "PKI Mount" zurückzuführen. Ein entfernter, authentisierter Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service Zustand herbeizuführen.

Open the full advisory

WID-SEC-W-2023-1542

Vulnerability from csaf_certbund - Published: 2023-06-22 22:00 - Updated: 2025-11-18 23:00

Summary

Red Hat OpenShift: Mehrere Schwachstellen

Severity

Hoch

Scope

93 vulnerabilities in this advisory, including CVE-2023-0665.

CVE-2023-0665

Known affected: 19 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2023-0665 (GCVE-0-2023-0665)

BDU:2025-06181 (CVE-2023-0665)

Vulnerability from bitnami_vulndb

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour