GHSA-j2rp-gmqv-frhv

ghsaUSosv

HashiCorpVault does not correctly validate OCSP responses

view advisory published 2024-04-04Licence: CC-BY-4.0

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. Fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-2660US	medium6.8	0.30% (23rd)	—	2024-04-04
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660,…

references

External citations — patches, advisories, analysis.

https://discuss.hashicorp.com/t/hcsec-2024-07-vault-tls-cert-auth-method-did-not-correctly-validate-ocsp-responses/64573WEB
https://github.com/hashicorp/vaultPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2024-2660ADVISORY
https://security.netapp.com/advisory/ntap-20240524-0007WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan