PT-2024-2960 · Hashicorp+1 · Vault Enterprise+2

Published 2024-04-04 · Updated 2025-08-08 · CVE-2024-2660

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Vault versions 1.14.0 through 1.15.6 Vault Enterprise versions 1.14.0 through 1.14.10 and 1.15.0 through 1.15.6

Description The issue is related to the incorrect validation of OCSP responses when one or more OCSP sources are configured in the TLS certificates auth method. This could potentially allow an attacker to bypass the authentication process.

Recommendations For Vault versions 1.14.0 through 1.15.6, update to Vault 1.16.0 or later. For Vault Enterprise versions 1.14.0 through 1.14.10, update to Vault Enterprise 1.14.11 or later. For Vault Enterprise versions 1.15.0 through 1.15.6, update to Vault Enterprise 1.15.7 or later.

Fix

Weakness Enumeration

CWE-703

CWE-636

Related Identifiers

BDU:2024-03127

BIT-VAULT-2024-2660

CVE-2024-2660

GHSA-J2RP-GMQV-FRHV

GO-2024-2690

OPENSUSE-SU-2024:14104-1

Affected Products

Red Os

Vault

Vault Enterprise

References · 17

• https://discuss.hashicorp.com/t/hcsec-2024-07-vault-tls-cert-auth-method-did-not-correctly-validate-ocsp-responses/64573 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-2660 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14104-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-2660 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-vault-2024-2660 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-2690 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03127 · Security Note
• https://osv.dev/vulnerability/GHSA-j2rp-gmqv-frhv · Vendor Advisory
• https://github.com/hashicorp/vault · Note
• https://vuldb.com/ru/?id.259402 · Note
• https://github.com/advisories/GHSA-j2rp-gmqv-frhv · Note
• https://t.me/cveNotify/131495 · Telegram Post
• https://security.netapp.com/advisory/ntap-20240524-0007 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-vault-05-08-24 · Note