Bug 2273634 (CVE-2024-2660) - CVE-2024-2660 Vault: Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses
Summary: CVE-2024-2660 Vault: Vault TLS Cert Auth Method Did Not Correctly Validate OC...
Keywords:
Status: NEW
Alias: CVE-2024-2660
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2273635 2273636 2273637 2273638 2273639 2273640 2273641 2273642
Blocks: 2278635
TreeView+ depends on / blocked
 
Reported: 2024-04-05 12:40 UTC by Avinash Hanwate
Modified: 2025-05-06 11:41 UTC (History)
8 users (show)

Fixed In Version: Vault 1.16.0
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Avinash Hanwate 2024-04-05 12:40:45 UTC 
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. Fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.

https://discuss.hashicorp.com/t/hcsec-2024-07-vault-tls-cert-auth-method-did-not-correctly-validate-ocsp-responses/64573
Note You need to log in before you can comment on or make changes to this bug.