CVE-2020-24359

Published: Aug 20, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP address assigned to that interface. Fixed in 0.2.0.

Affected (1)

Products: Hashicorp: Vault Ssh Helper

Hashicorp

1 product

Vault Ssh Helper

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Hashicorp Vault Ssh Helper	Before 0.2.0

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

https://github.com/hashicorp/vault-ssh-helper/blob/master/CHANGELOG.md#020-august-19-2020

Source: cve@mitre.org

Third Party Advisory

https://github.com/hashicorp/vault-ssh-helper/releases

Source: cve@mitre.org

Third Party Advisory

https://github.com/hashicorp/vault-ssh-helper/blob/master/CHANGELOG.md#020-august-19-2020

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://github.com/hashicorp/vault-ssh-helper/releases

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.