Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-2660

Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.

Published

2024-04-04T18:15:14.783

Last Modified

2025-08-08T19:00:18.940

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.4 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-636
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application hashicorp vault < 1.14.11 Yes
Application hashicorp vault < 1.16.0 Yes
Application hashicorp vault < 1.15.7 Yes
References