CVE-2022-41316

MEDIUM Year: 2022
CVSS v3 Score
5.3
Medium
Weakness Type
CWE-295
View all →

Vulnerability Description

HashiCorp Vault and Vault Enterprise’s TLS certificate auth method did not initially load the optionally configured CRL issued by the role's CA into memory on startup, resulting in the revocation list not being checked if the CRL has not yet been retrieved. Fixed in 1.12.0, 1.11.4, 1.10.7, and 1.9.10.

Related Vulnerabilities

CVE-2011-2207

MEDIUM
CVSS:5.3(Medium)

dirmngr before 2.1.0 improperly handles certain system calls, which allows remote attackers to cause a denial of service (DOS) via a specially-crafted certificate.

CWE-2952011

CVE-2016-11076

MEDIUM
CVSS:5.3(Medium)

An issue was discovered in Mattermost Server before 3.0.0. It does not ensure that a cookie is used over SSL.

CWE-2952016

CVE-2016-5648

MEDIUM
CVSS:5.3(Medium)

Acer Portal app before 3.9.4.2000 for Android does not properly validate SSL certificates, which allows remote attackers to perform a Man-in-the-middle attack via a crafted SSL certificate.

CWE-2952016

CVE-2017-1000417

MEDIUM
CVSS:5.3(Medium)

MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs (e.g. in ExtKeyUsage extension) on X.509 certificates.

CWE-2952017

CVE-2017-18588

MEDIUM
CVSS:5.3(Medium)

An issue was discovered in the security-framework crate before 0.1.12 for Rust. Hostname verification for certificates does not occur if ClientBuilder uses custom root certificates.

CWE-2952017

CVE-2017-2623

MEDIUM
CVSS:5.3(Medium)

It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering. Packages with unsigned or badly signed content could fail t...

CWE-2952017