{"id":"CVE-2024-2660","aliases":["BIT-vault-2024-2660","EUVD-2024-1224","GHSA-j2rp-gmqv-frhv","GO-2024-2690","openSUSE-SU-2024:14104-1"],"status":"published","title":"Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses","description":"Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00303,"percentile":0.23392,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-636","CWE-703"],"published":"2024-04-04T17:55:20Z","modified":"2026-10-28T02:31:09Z","fixes":[{"ecosystem":"Go","package":"github.com/hashicorp/vault","fixed_in":["1.16.0"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"vault","fixed_in":["1.16.0"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"sops","fixed_in":["3.9.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"vault","ranges":[{"type":"SEMVER","events":[{"introduced":"1.14.0"},{"fixed":"1.16.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/hashicorp/vault","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.16.0"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sops","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.9.0-1.1"}]}]}],"products":[{"vendor":"hashicorp","product":"vault"},{"vendor":"hashicorp","product":"vault enterprise"}],"references":[{"url":"https://discuss.hashicorp.com/t/hcsec-2024-07-vault-tls-cert-auth-method-did-not-correctly-validate-ocsp-responses/64573","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240524-0007/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-2660","tags":["web","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240524-0007","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j2rp-gmqv-frhv","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/2xxx/CVE-2024-2660.json","tags":["advisory"]},{"url":"https://github.com/hashicorp/vault","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-2660","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-2660","title":"Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses","description":"Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.","status":"published","published":"2024-04-04T17:55:20.192Z","modified":"2024-09-26T00:13:17.242Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-636"],"updated_at":"2026-11-02T14:34:10.258163Z"}],"euvd":[{"id":"EUVD-2024-1224","description":"Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.","status":"published","published":"2024-04-04T17:55:20Z","modified":"2024-09-26T00:13:17Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-03T00:28:10.832665Z"}],"ghsa":[{"id":"GHSA-j2rp-gmqv-frhv","title":"HashiCorpVault does not correctly validate OCSP responses","description":"Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. Fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.","status":"published","published":"2024-04-04T18:30:34Z","modified":"2024-09-26T16:45:52Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-636","CWE-703"],"updated_at":"2026-11-02T14:38:06.29677Z"}],"nvd":[{"id":"CVE-2024-2660","description":"Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.","status":"published","published":"2024-04-04T18:15:14.783Z","modified":"2026-06-17T07:24:59.44Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-636"],"updated_at":"2026-11-02T14:09:48.152273Z"}],"osv":[{"id":"CVE-2024-2660","title":"Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses","description":"Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.","status":"published","published":"2024-04-04T17:55:20.192Z","modified":"2026-10-28T02:31:09.364237997Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-636"],"updated_at":"2026-11-02T15:44:39.244433Z"},{"id":"GHSA-j2rp-gmqv-frhv","title":"HashiCorpVault does not correctly validate OCSP responses","description":"Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. Fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.","status":"published","published":"2024-04-04T18:30:34Z","modified":"2026-09-10T03:50:11.377952058Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-636","CWE-703"],"updated_at":"2026-11-02T15:46:49.977351Z"},{"id":"BIT-vault-2024-2660","title":"Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses","description":"Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. This vulnerability, CVE-2024-2660, affects Vault and Vault Enterprise 1.14.0 and above, and is fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.","status":"published","published":"2024-05-01T07:38:05.608Z","modified":"2026-09-08T08:48:21.436952807Z","updated_at":"2026-11-02T15:28:36.104787Z"},{"id":"GO-2024-2690","title":"HashiCorpVault does not correctly validate OCSP responses in github.com/hashicorp/vault","description":"HashiCorpVault does not correctly validate OCSP responses in github.com/hashicorp/vault","status":"published","published":"2024-06-04T15:19:21Z","modified":"2026-02-04T03:24:40.584227Z","updated_at":"2026-11-02T15:47:01.453823Z"},{"id":"openSUSE-SU-2024:14104-1","title":"sops-3.9.0-1.1 on GA media","description":"These are all security issues fixed in the sops-3.9.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-04T00:00:00Z","modified":"2026-02-04T02:38:57.729591Z","updated_at":"2026-11-02T16:58:36.662953Z"}]}}