CVE-2024-2660CWE-636

Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses

Medium · published April 4, 2024

CVSS v3.1
6.4
EPSS
0%
Percentile
21.9
In the wild
Unconfirmed
What it is

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00303 · 21.9th percentile
Weakness
CWE-636 · Not Failing Securely ('Failing Open')
Published
2024-04-04T17:55Z
EPSS history
Timeline
  • 04 APR 17:55Z
    Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses
    cvelistv5