Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. Fixed in Vault 1.15.5 and 1.14.10.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: HashiCorp

Published: 2024-03-04T19:56:47.253Z

Updated: 2024-08-08T15:18:54.316Z

Reserved: 2024-03-01T00:03:34.034Z

Link: CVE-2024-2048

cve-icon Vulnrichment

Updated: 2024-08-01T19:03:37.841Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-03-04T20:15:50.690

Modified: 2024-06-10T17:16:25.067

Link: CVE-2024-2048

cve-icon Redhat

No data.