BIT-vault-2024-2660

vendorUSosv

Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses

view advisory published 2024-05-01Licence: per source

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-2660US	medium6.8	0.30% (23rd)	—	2024-04-04
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660,…

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.com/t/hcsec-2024-07-vault-tls-cert-auth-method-did-not-correctly-validate-ocsp-responses/64573ADVISORY
https://nvd.nist.gov/vuln/detail/CVE-2024-2660WEB
https://security.netapp.com/advisory/ntap-20240524-0007/ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan