CVE-2023-0690CWE-312

Boundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service Configured

Medium · published February 8, 2023

CVSS v3.1
5.0
EPSS
0%
Percentile
37.0
In the wild
Unconfirmed
What it is

HashiCorp Boundary from 0.10.0 through 0.11.2 contain an issue where when using a PKI-based worker with a Key Management Service (KMS) defined in the configuration file, new credentials created after an automatic rotation may not have been encrypted via the intended KMS. This would result in the credentials being stored in plaintext on the Boundary PKI worker’s disk.

This issue is fixed in version 0.12.0.

The record
Technical detail
CVSS v3.1
5.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00437 · 37.0th percentile
Weakness
CWE-312 · Cleartext Storage of Sensitive Information
Published
2023-02-08T18:27Z
EPSS history
Timeline
  • 08 FEB 18:27Z
    Boundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service Configured
    cvelistv5