cloud
Imported story
GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption
Source: The Hacker News · Published · Last checked 11 minutes ago · 1 min read
Read original source ↗ (thehackernews.com)
Publisher excerpt From The Hacker News
The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked
Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.