GitHub Advisoryadvisory · Go

GHSA-j2rp-gmqv-frhv HashiCorpVault does not correctly validate OCSP responses

MEDIUM Published 2024-04-04 Modified 2024-09-26 Official page ↗
Aliases
CVE-2024-2660
Ecosystem
Go
Packages
github.com/hashicorp/vault
Severity
Moderate
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-636, CWE-703
Reviewed
2024-04-04

Affected packages

• Go github.com/hashicorp/vault: < 1.16.0 → fixed in 1.16.0

Description

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. Fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.

Related

Alias · CVE (1)

  • CVE-2024-2660 Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were… vulnerability

Weakness · CWE (2)

  • CWE-636 Not Failing Securely weakness
  • CWE-703 Improper Check or Handling of Exceptional Conditions weakness

References