CVE-2024-6299
Use of a Key Past its Expiration Date in Conduit
- State
- Published
- Severity
- 4.8 Medium
- Published
- Jun 25, 2024
- Updated
- Aug 29, 2024
- Reserved
- Jun 25, 2024
Description
Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forge requests as the remote server, as well as PDUs with timestamps past the expiry date
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.8 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N | GitLab |
Weaknesses
- CWE-324 Use of a Key Past its Expiration Date
Affected Products
| Product | Versions |
|---|---|
ConduitThe Conduit Contributors |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.