CVE-2024-6468

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-6468
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6468.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-6468
Aliases
Related
Published
2024-07-11T20:40:12.298Z
Modified
2026-07-15T01:49:13.839846985Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior
Details

Vault and Vault Enterprise did not properly handle requests originating from unauthorized IP addresses when the TCP listener option, proxyprotocolbehavior, was set to denyunauthorized. When receiving a request from a source IP address that was not listed in proxyprotocolauthorizedaddrs, the Vault API server would shut down and no longer respond to any HTTP requests, potentially resulting in denial of service.

While this bug also affected versions of Vault up to 1.17.1 and 1.16.5, a separate regression in those release series did not allow Vault operators to configure the deny_unauthorized option, thus not allowing the conditions for the denial of service to occur.

Fixed in Vault and Vault Enterprise 1.17.2, 1.16.6, and 1.15.12.

Database specific 
{
    "cna_assigner": "HashiCorp",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6468.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "1.10.0"
                },
                {
                    "fixed": "1.15.11"
                },
                {
                    "introduced": "1.10.0"
                },
                {
                    "fixed": "1.15.11"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ],
    "cwe_ids": [
        "CWE-703"
    ]
}
References

Affected packages

Git / github.com/hashicorp/vault

Affected ranges

Type
GIT
Repo
https://github.com/hashicorp/vault
Events
Introduced
72850df1bc10581b74ba5f0f7b3736f31c034235
Fixed
2af5655e364f697a15b1dc2db2c3f85f6ef949f2
Database specific 
{
    "cpe": [
        "cpe:2.3:a:hashicorp:vault:*:*:*:*:-:*:*:*",
        "cpe:2.3:a:hashicorp:vault:*:*:*:*:enterprise:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "1.17.0"
        },
        {
            "fixed": "1.17.2"
        }
    ],
    "source": "CPE_RANGE"
}

Affected versions

v1.*
v1.17.0
v1.17.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-6468.json"