title: Vault TLS Cert Auth Method Did Not Correctly Validate OCSP Responses
description: Vault and Vault Enterprise TLS certificates auth method did not correctly validate OCSP responses when one or more OCSP sources were configured. Fixed in Vault 1.16.0 and Vault Enterprise 1.16.1, 1.15.7, and 1.14.11.
problem types: CWE-703: Improper Check or Handling of Exceptional Conditions
affected:
{
defaultStatus: unaffected
platforms: [64 bit, 32 bit, x86, ARM, MacOS, Windows, Linux]
product: Vault
repo: https://github.com/hashicorp/vault
vendor: HashiCorp
versions:
lessThan: 1.16.0, status: affected, version: 1.14.0, versionType: semver
}
{
defaultStatus: unaffected
platforms: [64 bit, 32 bit, x86, ARM, MacOS, Windows, Linux]
product: Vault Enterprise
repo: https://github.com/hashicorp/vault
vendor: HashiCorp
versions:
changes: [at: 1.14.11, status: unaffected], lessThan: 1.16.0, status: affected, version: 1.14.0, versionType: semver
}
metrics:
cvssV3_1: [
baseScore: 6.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL