THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Fathom (Privacy friendly web analytics)
Zendesk (Helpdesk and Chat)

Ok

Home | EN
Support
CVE
PUBLISHED

CVE-2024-6299

Use of a Key Past its Expiration Date in Conduit

AssignerGitLab
Reserved2024-06-25
Published2024-06-25
Updated2024-07-05

Description

Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forge requests as the remote server, as well as PDUs with timestamps past the expiry date



MEDIUM: 4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Problem types

CWE-324: Use of a Key Past its Expiration Date

Product status

Default status
unaffected

Any version before 0.8.0
affected

Credits

Michael Maltsev for finding vulnerability, Matthias Ahouansou for fixing it finder

References

https://gitlab.com/famedly/conduit/-/releases/v0.8.0

https://conduit.rs/changelog/#v0-8-0-2024-06-12

cve.org CVE-2024-6299

nvd.nist.gov CVE-2024-6299

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-6299
© Copyright 2024 THREATINT. Made in Cyprus with +