CVE-2024-2048

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-2048

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2048.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-2048

Aliases

Related

CGA-rm8j-r4jg-5482

Published

2024-03-04T20:15:50.690Z

Modified

2026-03-14T12:28:27.068485Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. Fixed in Vault 1.15.5 and 1.14.10.

References

Affected packages

Git / github.com/hashicorp/vault

Affected ranges

Type

GIT

Repo

https://github.com/hashicorp/vault

Events

Introduced

Fixed

7d15950da2e3d835077f5b896354de5c01f27570

Introduced

Fixed

7d15950da2e3d835077f5b896354de5c01f27570

Introduced

b4d07277a6c5318bb50d3b94bbd6135dccb4c601

Fixed

0d8b67ef63815f20421c11fe9152d435af3403e6

Introduced

b4d07277a6c5318bb50d3b94bbd6135dccb4c601

Fixed

0d8b67ef63815f20421c11fe9152d435af3403e6

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.14.10"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "1.14.10"
        },
        {
            "introduced": "1.15.0"
        },
        {
            "fixed": "1.15.5"
        },
        {
            "introduced": "1.15.0"
        },
        {
            "fixed": "1.15.5"
        }
    ]
}

Type

GIT

Repo

https://github.com/openbao/openbao

Events

Introduced

Fixed

700fe3f27ab1f0ec39ce20c36f6d9d97c9fe6ac3

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.0.0"
        }
    ]
}

Affected versions

api/auth/approle/v0.*

api/auth/approle/v0.1.0

api/auth/approle/v0.1.1

api/auth/approle/v0.2.0

api/auth/approle/v0.3.0

api/auth/approle/v0.4.0

api/auth/approle/v0.4.1

api/auth/approle/v1.*

api/auth/approle/v1.1.0-development20240408

api/auth/aws/v0.*

api/auth/aws/v0.1.0

api/auth/aws/v0.2.0

api/auth/aws/v0.3.0

api/auth/aws/v0.4.0

api/auth/aws/v0.4.1

api/auth/aws/v1.*

api/auth/aws/v1.1.0-development20240408

api/auth/azure/v0.*

api/auth/azure/v0.1.0

api/auth/azure/v0.2.0

api/auth/azure/v0.3.0

api/auth/azure/v0.4.0

api/auth/azure/v0.4.1

api/auth/azure/v1.*

api/auth/azure/v1.1.0-development20240408

api/auth/gcp/v0.*

api/auth/gcp/v0.1.0

api/auth/gcp/v0.2.0

api/auth/gcp/v0.3.0

api/auth/gcp/v0.4.0

api/auth/gcp/v0.4.1

api/auth/gcp/v1.*

api/auth/gcp/v1.1.0-development20240408

api/auth/kubernetes/v1.*

api/auth/kubernetes/v1.1.0-development20240408

api/auth/ldap/v1.*

api/auth/ldap/v1.1.0-development20240408

api/auth/userpass/v0.*

api/auth/userpass/v0.1.0

api/auth/userpass/v0.2.0

api/auth/userpass/v0.3.0

api/auth/userpass/v0.4.0

api/auth/userpass/v0.4.1

api/auth/userpass/v1.*

api/auth/userpass/v1.1.0-development20240408

api/v1.*

api/v1.0.1

api/v1.0.2

api/v1.0.3

api/v1.0.4

api/v1.1.1

api/v1.100.0-development20240408

api/v1.2.0

api/v1.3.1

api/v1.5.0

api/v1.6.0

api/v1.7.0

api/v1.7.1

api/v1.7.2

api/v1.8.0

api/v1.8.1

api/v1.8.2

api/v1.8.3

api/v1.9.0

api/v1.9.1

api/v1.9.2

Other

before-plugin-removal

fork-point

sdk/v0.*

sdk/v0.1.10

sdk/v0.1.11

sdk/v0.1.12

sdk/v0.1.13

sdk/v0.1.8

sdk/v0.1.9

sdk/v0.10.2

sdk/v0.2.1

sdk/v0.3.0

sdk/v0.4.1

sdk/v0.5.0

sdk/v0.5.1

sdk/v0.5.3

sdk/v0.6.0

sdk/v0.6.1

sdk/v0.6.2

sdk/v0.7.0

sdk/v0.8.0

sdk/v0.9.0

sdk/v0.9.1

sdk/v1.*

sdk/v1.100.0-development20240408

v1.*

v1.15.0

v1.15.1

v1.15.2

v1.15.3

v1.15.4

v2.*

v2.0.0-alpha20240329

v2.0.0-beta20240618

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-2048.json"