Skip to content
CVE PROGRAM SOURCE RECORD6.4 Medium

CVE-2024-2660

Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
HashiCorp

Description

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

HashiCorp Vault

Default version status: unaffected

  • 1.14.0 to < 1.16.0affected

HashiCorp Vault Enterprise

Default version status: unaffected

  • 1.14.0 to < 1.16.0affected

References