Vulnerability · Published Apr 4, 2024 · Assigned by HashiCorp
CVE-2024-2660Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses
Medium 6.4
In plain English
A medium-severity security flaw in Vault from HashiCorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/hashicorp/vault | 1.16.0 | GHSA-j2rp-gmqv-frhv |
| Go | github.com/hashicorp/vault | 1.16.0 | GO-2024-2690 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| HashiCorp | Vault | 1.14.0 – before 1.16.0 |
| HashiCorp | Vault Enterprise | 1.14.0 – before 1.16.0 |
Weakness: CWE-636 · Vector: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H