Improper Input Validation in vault-ssh-helper

ALTO 7.5CVE-2020-24359 · GHSA-f9fq-vjvh-779p · GO-2022-0824 · Published 20/08/2020 · updated 17/06/2026

In breve

CVE-2020-24359 è una vulnerabilità ALTO (CVSS 7.5) che riguarda github.com/hashicorp/vault-ssh-helper, vault-ssh-helper (hashicorp).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.0%, superiore al 63.9% delle vulnerabilità.
Correzione: aggiornare a 0.2.0 o successiva.

Package	Affected versions	Patched versions
github.com/hashicorp/vault-ssh-helper Go	`< 0.2.0`	`0.2.0`
vault-ssh-helper hashicorp	`< 0.2.0`	`0.2.0`

Description

HashiCorp vault-ssh-helper (github.com/hashicorp/vault-ssh-helper/helper) up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP address assigned to that interface. Fixed in 0.2.0.

NVD description

HashiCorp vault-ssh-helper up to and including version 0.1.6 incorrectly accepted Vault-issued SSH OTPs for the subnet in which a host's network interface was located, rather than the specific IP address assigned to that interface. Fixed in 0.2.0.

References

nvd.nist.gov/vuln/detail/CVE-2020-24359 · ADVISORY
hashicorp/vault-ssh-helper commit 83effd0 · WEB
hashicorp/vault-ssh-helper · WEB
hashicorp/vault-ssh-helper release · WEB
GitHub Advisory GHSA-f9fq-vjvh-779p · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free