CVE-2023-20209

I started looking at Cisco Expressway after I noticed quite a few of them on the internet during Red Team engagements, but never had the time during work to explore the product further. Initially I was looking for an auth bypass to chain into RCE but ran out of time and settled on a post auth RCE...

openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS by presenting a specially crafted certificate during a Transport Layer Security TLS handshake. When OpenSSL processes and caches certificate extensions containing numerous Certificate Revocation List CRL distribution...

openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing

A flaw was found in OpenSSL. A remote attacker can cause a Denial of Service DoS by presenting a specially crafted certificate during a Transport Layer Security TLS handshake. When OpenSSL processes and caches certificate extensions containing numerous Certificate Revocation List CRL distribution...

CVE-2026-123552

OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distribution point named in a presented certificate without restricting the destination or verifying the downloaded CRL's signature. Attackers holding a...

CVE-2026-123552

Versions of OpenAM prior to 16.1.4 are vulnerable to a server-side request forgery (SSRF) and CRL tampering vulnerability. The flaw exists in the certificate CRL checking mechanism, which fetches CRLs from the distribution point specified in a presented certificate without restricting the destina...

CVE-2026-123552 OpenAM before 16.1.4 SSRF and CRL Tampering via Certificate CRL Distribution Point

OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distribution point named in a presented certificate without restricting the destination or verifying the downloaded CRL's signature. Attackers holding a...

EUVD-2026-119437

OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distribution point named in a presented certificate without restricting the destination or verifying the downloaded CRL's signature. Attackers holding a...

CVE-2026-123552 OpenAM before 16.1.4 SSRF and CRL Tampering via Certificate CRL Distribution Point

OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distribution point named in a presented certificate without restricting the destination or verifying the downloaded CRL's signature. Attackers holding a...

PT-2026-139833

Name of the Vulnerable Software and Affected Versions OpenAM versions prior to 16.1.4 Description An issue exists in the certificate CRL Certificate Revocation List checking process where the system fetches CRLs from the distribution point specified in a presented certificate without restricting...

CVE-2026-123552: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs…

OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs from the distribution point named in a presented certificate without restricting the destination or verifying the downloaded CRL's signature. Attackers holding a...

CVE-2026-116677

A flaw was found in openwisp-controller. An authorization bypass vulnerability in the certificate revocation list CRL download endpoint allows an authenticated user with Certificate Authority CA view permissions to retrieve CRL data belonging to other organizations by specifying their sequential ...

openSUSE 16: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (openSUSE-SU-2026:22175-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22175-1 advisory. - CVE-2026-93599: rustls-webpki: panic in BorrowedCertRevocationList::fromder via empty BIT STRING in IssuingDistributionPoint bsc1282250. -...

CLEANSTART-2024-VT82974 vulnerability was found in the Libksba library due to an integer overflow within the CRL parser

Security vulnerability affects the libksba package. A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser...

Security update for aws-nitro-enclaves-cli (important)

openSUSE security update: security update for aws-nitro-enclaves-cli ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22175-1 Rating: important References: bsc1271853 bsc1282250 Cross-References: CVE-2026-93599 CVE-2026-93600 CVE-2026-93601...

OpenWISP Controller CA CRL REST API does not scope requests to managed organizations

Summary The authenticated REST API endpoint for downloading a CA Certificate Revocation List resolves the requested CA without applying the organization-scoped queryset used by the rest of the PKI API. An organization manager with CA view permission can request another organization's sequential C...

EUVD-2026-111234

OpenWISP Controller CA CRL REST API does not scope requests to managed organizations...

GHSA-9GH4-XW24-9XH5 OpenWISP Controller CA CRL REST API does not scope requests to managed organizations

Summary The authenticated REST API endpoint for downloading a CA Certificate Revocation List resolves the requested CA without applying the organization-scoped queryset used by the rest of the PKI API. An organization manager with CA view permission can request another organization's sequential C...

Low: ecs-service-connect-agent

Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2026-3355)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3355 advisory. Issue summary: A certificate with many nameRelativeToCRLIssuer CRLdistribution points causes disproportionate heap growth when OpenSSL cachesX.509 extensions. Impact summary: Receiving a crafted...

Low: ecs-service-connect-agent

Issue Overview: Issue summary: A certificate with many nameRelativeToCRLIssuer CRL distribution points causes disproportionate heap growth when OpenSSL caches X.509 extensions. Impact summary: Receiving a crafted certificate from a malicious peer can lead to significant memory pressure and possib...