As cited
Copy frozen at (site build).
vulnerabilities
GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption
GoAhead embedded web server fails to validate certificate revocation lists in its OpenSSL backend when configured for mutual TLS authentication, allowing revoked client certificates to authenticate successfully. The flaw affects systems where a revocation list is configured but the validation mechanism is not enabled, potentially enabling unauthorized access and session decryption.
Why it matters: Practitioners deploying GoAhead with mutual TLS and client certificate revocation lists should verify whether revocation checking is active, as an attacker with a revoked certificate may still authenticate and decrypt sessions.
- Source published
- First seen by Cybersecurity Tracker