Use of a Key Past its Expiration Date in Conduit
Priority LOW 21CWE-324Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forge requests as the remote server, as well as PDUs with timestamps past the expiry date
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00161 5th percentileScored 2026-11-07
Fix Fixed Conduit (The Conduit Contributors): 0.8.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| The Conduit Contributors | Conduit | before 0.8.0 | 0.8.0 | Patch available | CNA |
- Conduit VendorThe Conduit Contributors Affected before 0.8.0 Fixed in 0.8.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:conduit:conduit:*:*:*:*:*:*:*:* | before 0.8.0 | Vulnerable | The Conduit Contributors |
- cpe:2.3:a:conduit:conduit:*:*:*:*:*:*:*:* Versions before 0.8.0 Vulnerable ·The Conduit Contributors
Remediation
- Fix · CNA Conduit (The Conduit Contributors) Fixed in 0.8.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
The Conduit Contributors Conduit 0.8.0
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2024-05850 Missing Authorization in ConduitPriority MEDIUM 43
- TI-2024-05848 Origin Validation Error in ConduitPriority LOW 38
- TI-2024-05847 Incomplete Cleanup in ConduitPriority LOW 24
Timeline
- 2026-10-02 Threatist record created from CVE-2024-6299
- 2026-10-03 Alias added: GHSA-283c-79hh-mfp9
References
More The Conduit Contributors Conduit vulnerabilities
- TI-2024-05850 Missing Authorization in Conduit CVSS 3.1CRITICAL 9.9
- TI-2024-05848 Origin Validation Error in Conduit CVSS 3.1HIGH 7.5
- TI-2024-05849 Improper Handling of Insufficient Permissions or Privileges in Conduit CVSS 3.1HIGH 8.1
- TI-2024-05847 Incomplete Cleanup in Conduit CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-6299 · CVE Program
- CVE-2024-6299 · NVD
- FIRST EPSS
- GHSA-283c-79hh-mfp9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences