data/reports: add GO-2024-2617.yaml

Aliases: CVE-2024-2048, GHSA-r3w7-mfpm-c2vw

Fixes #2617

Change-Id: Ie67b630e60002c213349b90187f6fd47bb0604f5
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/570724
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>

data/osv/GO-2024-2617.json

@@ -0,0 +1,53 @@
+{
+ "schema_version": "1.3.1",
+ "id": "GO-2024-2617",
+ "modified": "0001-01-01T00:00:00Z",
+ "published": "0001-01-01T00:00:00Z",
+ "aliases": [
+ "CVE-2024-2048",
+ "GHSA-r3w7-mfpm-c2vw"
+ ],
+ "summary": "Authentication bypass in github.com/hashicorp/vault",
+ "details": "The TLS certificate authentication method incorrectly validates client certificates when configured with a non-CA certificate as a trusted certificate. When configured this way, attackers may be able to craft a certificate that can be used to bypass authentication.",
+ "affected": [
+ {
+ "package": {
+ "name": "github.com/hashicorp/vault",
+ "ecosystem": "Go"
+ },
+ "ranges": [
+ {
+ "type": "SEMVER",
+ "events": [
+ {
+ "introduced": "0"
+ },
+ {
+ "fixed": "1.14.10"
+ },
+ {
+ "introduced": "1.15.0"
+ },
+ {
+ "fixed": "1.15.5"
+ }
+ ]
+ }
+ ],
+ "ecosystem_specific": {}
+ }
+ ],
+ "references": [
+ {
+ "type": "ADVISORY",
+ "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2048"
+ },
+ {
+ "type": "WEB",
+ "url": "https://discuss.hashicorp.com/t/hcsec-2024-05-vault-cert-auth-method-did-not-correctly-validate-non-ca-certificates/63382"
+ }
+ ],
+ "database_specific": {
+ "url": "https://pkg.go.dev/vuln/GO-2024-2617"
+ }
+}

data/reports/GO-2024-2617.yaml

@@ -0,0 +1,21 @@
+id: GO-2024-2617
+modules:
+ - module: github.com/hashicorp/vault
+ versions:
+ - fixed: 1.14.10
+ - introduced: 1.15.0
+ fixed: 1.15.5
+ vulnerable_at: 1.15.4
+summary: Authentication bypass in github.com/hashicorp/vault
+description: |-
+ The TLS certificate authentication method incorrectly validates client
+ certificates when configured with a non-CA certificate as a trusted certificate.
+ When configured this way, attackers may be able to craft a certificate that can
+ be used to bypass authentication.
+cves:
+ - CVE-2024-2048
+ghsas:
+ - GHSA-r3w7-mfpm-c2vw
+references:
+ - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-2048
+ - web: https://discuss.hashicorp.com/t/hcsec-2024-05-vault-cert-auth-method-did-not-correctly-validate-non-ca-certificates/63382