-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/hashicorp/vault | go | < 1.11.9 | 1.11.9 |
| github.com/hashicorp/vault | go | >= 1.12.0, < 1.12.5 | 1.12.5 |
| github.com/hashicorp/vault | go | >= 1.13.0, < 1.13.1 | 1.13.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from non-constant-time GF(2^8) operations in Shamir implementation. The pull request #19495 specifically modifies mult() and div() functions to eliminate table lookups (logTable/expTable) in favor of constant-time bitwise operations. These functions handled critical cryptographic operations during seal/unseal processes, and their original implementation using precomputed tables would leak cache access patterns observable through side-channels.
Ongoing coverage of React2Shell
GoGo