Vulnerability · Published Dec 12, 2024 · Assigned by HashiCorp
CVE-2024-12289Boundary Controller Incorrectly Handles HTTP Requests On Initialization Which May Lead to a Denial of Service
Medium 5.9
In plain English
A medium-severity security flaw in Boundary from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Boundary Community Edition and Boundary Enterprise (“Boundary”) incorrectly handle HTTP requests during the initialization of the Boundary controller, which may cause the Boundary server to terminate prematurely. Boundary is only vulnerable to this flaw during the initialization of the Boundary controller, which on average is measured in milliseconds during the Boundary startup process. This vulnerability, CVE-2024-12289, is fixed in Boundary Community Edition and Boundary Enterprise 0.16.4, 0.17.3, 0.18.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/hashicorp/boundary | 0.18.2 | GHSA-xx83-cxmq-x89m |
| Go | github.com/hashicorp/boundary | 0.18.2 | GO-2024-3335 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Boundary | 0.8.0 – before 0.18.2 |
| HashiCorp | Boundary Enterprise | 0.8.0 – before 0.18.2 |
Weakness: CWE-460 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H