CVE-2024-2660
Assigner: HashiCorp
Published: 2024-04-04T17:55:20.192Z
State: PUBLISHED
affected: defaultStatus: unaffected
platforms: 64 bit
32 bit
x86
ARM
MacOS
Windows
Linux
product: Vault
repo: https://github.com/hashicorp/vault
vendor: HashiCorp
versions: lessThan: 1.16.0
status: affected
version: 1.14.0
versionType: semver
defaultStatus: unaffected
platforms: 64 bit
32 bit
x86
ARM
MacOS
Windows
Linux
product: Vault Enterprise
repo: https://github.com/hashicorp/vault
vendor: HashiCorp
versions: changes: at: 1.14.11
status: unaffected
at: 1.15.7
status: unaffected
lessThan: 1.16.0
status: affected
version: 1.14.0
versionType: semver
descriptions: supportingMedia: base64: no
type: text/html
value: Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. Fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.
value: Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. Fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.
impacts: capecId: CAPEC-26
descriptions: value: CAPEC-26: Leveraging Race Conditions
metrics: cvssV3_1: baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-703
description: CWE-703: Improper Check or Handling of Exceptional Conditions
type: CWE
source: advisory: HCSEC-2024-07
discovery: INTERNAL
title: Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses