CVE-2024-6299

Published Jun 25, 2024

Last updated 2 months ago

Overview

Description: Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forge requests as the remote server, as well as PDUs with timestamps past the expiry date
Source: cve@gitlab.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 3.7
Impact score: 1.4
Exploitability score: 2.2
Vector string: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Severity: LOW

Weaknesses

nvd@nist.gov: NVD-CWE-Other
cve@gitlab.com: CWE-324

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:conduit:conduit:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0A42037C-F568-4862-BEE1-FCE796E55CD1",
            "versionEndExcluding": "0.8.0"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References