Vulnerability · Published Aug 20, 2020 · Assigned by mitre
CVE-2020-24359
High 7.5
In plain English
A high-severity security flaw in the github.com/hashicorp/vault-ssh-helper package (Go). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)1.0%top 35.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP address assigned to that interface. Fixed in 0.2.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/hashicorp/vault-ssh-helper | 0.2.0 | GHSA-f9fq-vjvh-779p |
| Go | github.com/hashicorp/vault-ssh-helper | 0.2.0 | GO-2022-0824 |