CVE-2023-0690
Medium
Description
HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted via the intended KMS. This would result in the credentials being stored in plaintext on the Boundary PKI worker’s disk. This issue is fixed in version 0.12.0.
SeverityMedium
CVSS5.0
Exploit probability—
ProductHashicorp Boundary
PublishedFeb 8, 2023
First seenFeb 8, 2023
Weakness typeCWE-312CWE-312
How to fix
Update
- hashicorp boundary0.12.0 or later
- github.com/hashicorp/boundary0.12.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hashicorp boundary | 0.10.0 ≤ v < 0.12.0 | 0.12.0 |
| github.com/hashicorp/boundaryGo | 0.10.0 ≤ v < 0.12.0 | 0.12.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.