Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. Fixed in Vault 1.15.5 and 1.14.10.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: HashiCorp
Published: 2024-03-04T19:56:47.253Z
Updated: 2024-08-08T15:18:54.316Z
Reserved: 2024-03-01T00:03:34.034Z
Link: CVE-2024-2048
Vulnrichment
Updated: 2024-08-01T19:03:37.841Z
NVD
Status : Awaiting Analysis
Published: 2024-03-04T20:15:50.690
Modified: 2024-06-10T17:16:25.067
Link: CVE-2024-2048
Redhat
No data.