~ / search / GHSA-vh73-q3rw-qx7w

GHSA-vh73-q3rw-qx7w

Boundary vulnerable to session hijacking through TLS certificate tampering

Source: GitHub Advisory Database (reviewed) High CVE-2024-1052

Packages

EcosystemPackageAffectedFixed in
Go github.com/hashicorp/boundary >= 0.8.0, < 0.15.0 0.15.0

Details

As written in the advisory (Markdown source, shown as plain text).

Boundary and Boundary Enterprise (“Boundary”) is vulnerable to session hijacking through TLS certificate tampering. An attacker with privileges to enumerate active or pending sessions, obtain a private key pertaining to a session, and obtain a valid trust on first use (TOFU) token may craft a TLS certificate to hijack an active session and gain access to the underlying service or application.

References

External links from the advisory. They lead to third-party sites.