lib32-gnutls: certificate verification bypass

ID ASA-201609-26
Type archlinux
Reporter Arch Linux
Modified 2016-09-26T00:00:00


Incorrect length validation on gnutls's gnutls_ocsp_resp_check_crt method can allow an attacker to use a OCSP response for a different certificate (but from the same CA) to continue using a revoked certificate. This can happen if the serial from the revoked certificate is a prefix of the other one, and the additional bytes happen to be equal on the system doing the verification.