id: GO-2024-2617
modules:
    - module: github.com/hashicorp/vault
      versions:
        - fixed: 1.14.10
        - introduced: 1.15.0
          fixed: 1.15.5
      vulnerable_at: 1.15.4
summary: Authentication bypass in github.com/hashicorp/vault
description: |-
    The TLS certificate authentication method incorrectly validates client
    certificates when configured with a non-CA certificate as a trusted certificate.
    When configured this way, attackers may be able to craft a certificate that can
    be used to bypass authentication.
cves:
    - CVE-2024-2048
ghsas:
    - GHSA-r3w7-mfpm-c2vw
references:
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2024-2048
    - web: https://discuss.hashicorp.com/t/hcsec-2024-05-vault-cert-auth-method-did-not-correctly-validate-non-ca-certificates/63382