GO-2024-2617
- Source
- https://pkg.go.dev/vuln/GO-2024-2617
- Import Source
- https://vuln.go.dev/ID/GO-2024-2617.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2024-2617
- Aliases
-
- BIT-vault-2024-2048
- CVE-2024-2048
- GHSA-r3w7-mfpm-c2vw
- Published
- 2024-03-14T17:13:04Z
- Modified
- 2024-05-20T16:03:47Z
- Summary
- Authentication bypass in github.com/hashicorp/vault
- Details
-
The TLS certificate authentication method incorrectly validates client certificates when configured with a non-CA certificate as a trusted certificate. When configured this way, attackers may be able to craft a certificate that can be used to bypass authentication.
- Database specific
{ "review_status": "REVIEWED", "url": "https://pkg.go.dev/vuln/GO-2024-2617" }- References
Affected packages
Go / github.com/hashicorp/vault
Package
- Name
- github.com/hashicorp/vault
- View open source insights on deps.dev
- Purl
- pkg:golang/github.com/hashicorp/vault