CVE-2020-24359

CVE-2020-24359 affects vault-ssh-helper up to and including version 0.1.6, where Vault-issued SSH OTPs were accepted for the subnet containing a host’s interface rather than the specific IP address assigned to that interface. The root cause is improper IP matching in vault-ssh-helper. The issue w...