GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption
· thehackernews.com · popularity 21/100 · 0 similar stories today
Read the original at thehackernews.com →
Summary
The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked
Found in: The Hacker News. Rating basis: single outlet; outlet tier 2 (unlisted); 1 feeds; feed position 2.