Three TLS Bugs in GoAhead

jkingsman

Oh boy. I wonder how many other companies that have previously been lax about validating that cert revocation is handled correctly by their devices are going to validate the eMudrha cert revocation and discover that they are not, in fact, handling revocation correctly. Yikes.

nderdweik

nice i abs like this

whizzter

This caught my eye, remember how the eMudhra certificates had weirdly low parameters, like 4 and others in the single digits? "Mbed TLS - Medium, CVSS 5.9 - A buffer-length typo reduces a 2048-bit DH modulus to one byte. TLS 1.2 DHE_RSA sessions are decryptable when the client accepts the broken parameters. GOAHEAD-SA-2026-0005." Not familiar with those implementation details but was this the root cause?

idlewords

Internet infrastructure companies using '5' as their private key are sweating bullets. They know they are next.

HexnMarcusWolfe

Here we go again ... can we please just get through the month without breaking the internet?

kfjgi84h

How many of these bugs are just backdoors?

FiloSottile

This is some serious severity inflation. Skipping CRL checks is not a Critical. A Critical is "whoops we were not checking the signature on the certificates" or "I guess all zeroes is a fine session ticket key" (both happened, the former in wolfSSL, the latter in GnuTLS). Bypassing chain length limits is... barely a Low? It's definitely not a High. The DHE one is fun. It'd have been valuable if they spent some tokens figuring out if any open source library would accept those broken parameters. If not, it doesn't really matter. (Another good reason not to negotiate DH parameters ever!)