← Back

CVE-2024-2660

nvd nist
Published: Apr 4, 2024Modified: Jun 17, 2026

JSON object

Loading...
6.8
Vector
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 0.9 / Impact: 5.9
Source: NVD

Description

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.

Affected (3)

Products: Hashicorp: Vault
Hashicorp
1 product
Vault
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Hashicorp
Vault
From 1.14.0 to 1.16.0
Vault
From 1.14.0 to 1.14.11
Vault
From 1.15.0 to 1.15.7

Related CWEs

CWE-636
Not Failing Securely ('Failing Open')
When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.

References (3)

Source: security@hashicorp.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.