Low severity2.5NVD Advisory· Published May 1, 2023· Updated Jun 17, 2026
CVE-2023-2197
CVE-2023-2197
Description
HashiCorp Vault Enterprise 1.13.0 up to 1.13.1 is vulnerable to a padding oracle attack when using an HSM in conjunction with the CKM_AES_CBC_PAD or CKM_AES_CBC encryption mechanisms. An attacker with privileges to modify storage and restart Vault may be able to intercept or modify cipher text in order to derive Vault’s root key. Fixed in 1.13.2
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
41.13.0+ 1 more
- (no CPE)range: 1.13.0
- (no CPE)range: 1.13.0 - 1.13.1
Patches
Vulnerability mechanics
References
2News mentions
0No linked articles in our index yet.