PT-2024-2153 · Hashicorp+2 · Hashicorp Vault+2

D0Nut · Published 2024-03-04 · Updated 2025-11-13 · CVE-2024-2048

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HashiCorp Vault versions prior to 1.14.10 HashiCorp Vault versions prior to 1.15.5

Description The issue is related to errors in the procedure for confirming the authenticity of certificates. An attacker may be able to craft a malicious certificate to bypass authentication when the TLS certificate authentication method is configured with a non-CA certificate as a trusted certificate.

Recommendations For HashiCorp Vault versions prior to 1.14.10, update to version 1.14.10 or later to resolve the issue. For HashiCorp Vault versions prior to 1.15.5, update to version 1.15.5 or later to resolve the issue. As a temporary workaround, consider restricting the use of the TLS certificate authentication method until a patch is available.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2024-11859

ALT-PU-2024-12202

ALT-PU-2024-12204

ALT-PU-2024-12410

BDU:2024-02063

BIT-VAULT-2024-2048

CVE-2024-2048

GHSA-R3W7-MFPM-C2VW

GO-2024-2617

Affected Products

Alt Linux

Hashicorp Vault

Red Os

References · 24

• https://discuss.hashicorp.com/t/hcsec-2024-05-vault-cert-auth-method-did-not-correctly-validate-non-ca-certificates/63382 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2048 · Security Note
• https://osv.dev/vulnerability/GHSA-r3w7-mfpm-c2vw · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2617 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2024-2048 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02063 · Security Note
• https://osv.dev/vulnerability/CVE-2024-2048 · Vendor Advisory
• https://github.com/hashicorp/vault · Note
• https://twitter.com/hdH4dg8/status/1765191797456928904 · Twitter Post
• https://twitter.com/Komodosec/status/1765026004681322959 · Twitter Post
• https://twitter.com/fofabot/status/1764968153992613931 · Twitter Post
• https://security.netapp.com/advisory/ntap-20240524-0009 · Note
• https://twitter.com/cracbot/status/1765055162710945940 · Twitter Post
• https://twitter.com/Dinosn/status/1764982020050927676 · Twitter Post