The vulnerability of HashiCorp’s Vault and Vault Enterprise archiving platforms for corporate information lies in improper validation or processing of exceptional conditions, allowing attackers to trigger service failures.

🗓️ 04 Sep 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 5 Views

Vault platforms fail service due to improper handling of exceptions and unauthorized addresses.

Reporter	Title	Published	Views	Family All 20
Chainguard	CVE-2024-6468 vulnerabilities	11 Jul 202421:15	–	cgr
Circl	CVE-2024-6468	12 Jul 202400:11	–	circl
CNNVD	HashiCorp Vault and HashiCorp Vault Enterprise Security Vulnerabilities	11 Jul 202400:00	–	cnnvd
CVE	CVE-2024-6468	11 Jul 202420:40	–	cve
Cvelist	CVE-2024-6468 Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior	11 Jul 202420:40	–	cvelist
EUVD	EUVD-2024-2227	3 Oct 202520:07	–	euvd
Github Security Blog	Hashicorp Vault vulnerable to Improper Check or Handling of Exceptional Conditions	11 Jul 202421:31	–	github
HashiCorp Security Advisories	Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior	11 Jul 202419:29	–	hashicorp
NVD	CVE-2024-6468	11 Jul 202421:15	–	nvd
OSV	BIT-VAULT-2024-6468 Vault Vulnerable to Denial of Service When Setting a Proxy Protocol Behavior	17 Jul 202407:39	–	osv

Vulners

Node

hashicorp vaultRange<1.16.5

OR

hashicorp vaultRange<1.17.1

OR

hashicorp vault_enterpriseRange<1.15.12

OR

hashicorp vault_enterpriseRange<1.16.6

OR

hashicorp vault_enterpriseRange<1.17.2

Source	Link
discuss	www.discuss.hashicorp.com/t/hcsec-2024-14-vault-vulnerable-to-denial-of-service-when-setting-a-proxy-protocol-behavior/68518
redos	www.redos.red-soft.ru/support/secure/
web	www.web.nvd.nist.gov/view/vuln/detail

04 Sep 2024 00:00Current

7.2High risk

Vulners AI Score7.2

CVSS 37.5

CVSS 27.8

EPSS0.00491

vault platforms unauthorized addresses exceptional conditions service failures enterprise archiving