CVE-2024-2660: hashicorp vault Failing Open
CVSS: 6.8v3.1MediumAnalyzed
AliasesCGA-j7j2-6v3p-99pjCGA-m549-gmr3-9fg5GHSA-j2rp-gmqv-frhvBIT-vault-2024-2660GO-2024-2690openSUSE-SU-2024:14104-1CGA-6fc2-m395-6v8gCGA-cx8r-jqvf-vqj2CGA-q87q-m7jv-rffqCGA-v39w-xv63-wjh9CGA-x34g-pccp-6jpc
Published 04-04-2024Last modified 26-09-2024
Vulnerability summary
CVE-2024-2660 is a medium (CVSS 6.8) Failing Open vulnerability in hashicorp vault. EPSS estimates a 0.30% chance of exploitation in the next 30 days, higher than 21.6% of scored vulnerabilities.
CVSS score
6.8/10
010
Medium · v3.1 (NVD)EPSS score
0.30%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 4Timeline
- 04-04-2024PublishedVulnerability first disclosed.
- 26-09-2024Last modifiedVulnerability information updated.
Description
Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 6.8Preferred score · NVD (NIST)
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HSources5 sources · 6.4–6.8
- CVE.orgCNA6.4MediumCVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · WolfiEcosystem advisory · calculated6.4MediumCVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · GoEcosystem advisory · calculated6.4MediumCVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HDiffers
- OSV · ChainguardEcosystem advisory · calculated6.4MediumCVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.30%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
0.00 pp
From 0.30% on 19-09-2026
19-09-202619-10-2026
EPSS score0.30%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard4 products
- k3d< 5.6.0-r11
- vault-1.16All versions (No fix recorded)
- vault-1.16-compatAll versions (No fix recorded)
- vault-fips-1.14< 1.14.11-r0
Hashicorp2 products
- vault≥ 1.14.0, < 1.14.11 | ≥ 1.14.0, < 1.16.0 | ≥ 1.15.0, < 1.15.7
- vault enterprise≥ 1.14.0, < 1.16.0
Github.com/hashicorp1 product
- vault< 1.16.0
Opensuse1 product
- sops&distro=openSUSE Tumbleweed< 3.9.0-1.1
Wolfi1 product
- k3d< 5.6.0-r11
5 vendors · 9 products
References
8 links
- github.com/hashicorp/vaultPACKAGE