AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

VaultGHSA-j2rp-gmqv-frhv

HashiCorpVault does not correctly validate OCSP responses

Vault

CVE-2024-2660 · Published Apr 4, 2024 · updated Sep 10, 2026

Medium6.4
Fix: upgrade to 1.16.0 or later
GitHub advisory

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. Fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.

Affected versions

PackageAffectedFixed in
github.com/hashicorp/vault
Go
< 1.16.01.16.0
Details and references
CVSS 3.1
CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-636, CWE-703
Also known as
BIT-vault-2024-2660, CVE-2024-2660, GO-2024-2690

More Vault advisories

All Vault
High 8.1Mar 4, 2024Incorrect TLS certificate auth method in VaultCVE-2024-2048fixed in 1.14.10 +1Medium 4.5Feb 1, 2024Hashicorp Vault may expose sensitive log informationCVE-2024-0831fixed in 1.15.5High 7.5Jan 31, 2024Improper Authentication in HashiCorp VaultCVE-2021-3282fixed in 1.6.2Medium 6.5Jan 31, 2024Enumeration of users in HashiCorp VaultCVE-2020-35177fixed in 1.5.6 +1High 8.2Jan 31, 2024HashiCorp Vault Authentication bypassCVE-2020-16251fixed in 1.2.5 +3Medium 5.3Jan 30, 2024HashiCorp Vault Improper Privilege ManagementCVE-2020-10660fixed in 1.3.4