Description (CNA)
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. Fixed in Vault 1.15.5 and 1.14.10.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| HashiCorp / Vault | affected 1.15.5 before 1.16.0 |
| HashiCorp / Vault Enterprise | affected 1.15.5 before 1.16.0 |
CWE
CWE-295
References
- https://discuss.hashicorp.com/t/hcsec-2024-05-vault-cert-auth-method-did-not-correctly-validate-non-ca-certificates/63382
- https://security.netapp.com/advisory/ntap-20240524-0009/
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.