What’s Vulnerable › Vulnerabilities

CVE-2024-6299: Use of a Key Past its Expiration Date in Conduit

• Severity: low (CVSS 3.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-25 · updated 2026-06-17
• Weakness: CWE-324

Description

Lack of consideration of key expiry when validating signatures in Conduit, allowing an attacker which has compromised an expired key to forge requests as the remote server, as well as PDUs with timestamps past the expiry date

Affected products

• The Conduit Contributors Conduit: before 0.8.0 — fixed in 0.8.0

How to fix

Upgrade to a fixed version: The Conduit Contributors Conduit 0.8.0. Check the vendor advisory for mitigations.

References

• https://conduit.rs/changelog/#v0-8-0-2024-06-12
• https://gitlab.com/famedly/conduit/-/releases/v0.8.0
• https://conduit.rs/changelog/#v0-8-0-2024-06-12
• https://gitlab.com/famedly/conduit/-/releases/v0.8.0

Get alerted when CVE-2024-6299 or the next vulnerability affects your stack