Executive Summary

This vulnerability involves a flaw in the OCSP (Online Certificate Status Protocol) implementation within wolfSSL, specifically in the function wolfSSL_OCSP_resp_find_status. The issue arises because the code compares certificate serial numbers without first checking if their lengths are equal. As a result, a SingleResponse for one certificate whose serial number is a prefix of another certificate's serial number (issued by the same issuer) can be mistakenly matched and reported as the revocation status of the other certificate. This means the system might return the wrong certificate's revocation status.

The fix for this vulnerability requires that the serial numbers must be of equal length before their bytes are compared, preventing incorrect matches.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to incorrect reporting of certificate revocation status. Specifically, a certificate might be incorrectly considered revoked or valid based on the status of a different certificate with a similar serial number prefix. This can undermine the trustworthiness of certificate validation processes, potentially allowing revoked certificates to be accepted or valid certificates to be rejected.

Useful 0 Not Useful 0