GHSA-r3w7-mfpm-c2vw
Incorrect TLS certificate auth method in Vault
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | github.com/hashicorp/vault | >= 1.15.0, < 1.15.5 | 1.15.5 |
| Go | github.com/hashicorp/vault | < 1.14.10 | 1.14.10 |
Details
As written in the advisory (Markdown source, shown as plain text).
Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as trusted certificate. In this configuration, an attacker may be able to craft a malicious certificate that could be used to bypass authentication. Fixed in Vault 1.15.5 and 1.14.10.
References
External links from the advisory. They lead to third-party sites.