Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks

Summary Netty's OcspClient does not validate that the CertificateID in an OCSP response matches the requested CertificateID. A bad actor can replay a GOOD status response issued for an unrelated certificate by the same CA to bypass revocation checks for any certificate. Details...