OCSP Response Replay in Netty Framework

Executive Summary

This vulnerability in Netty involves a flaw in the OCSP client validation process. The OcspClient does not verify that the CertificateID in an OCSP response matches the requested CertificateID. This allows an attacker to replay a legitimately signed 'GOOD' status response for an unrelated certificate issued by the same CA, bypassing revocation checks for another certificate.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves OCSP response validation in Netty. Detection requires checking if your Netty version is between 4.2.0.Final and 4.2.15.Final or prior to 4.1.135.Final. Use commands like 'find / -name "netty-*.jar" 2>/dev/null' to locate Netty JAR files and check their versions with 'unzip -p <jar-file> META-INF/MANIFEST.MF | grep Implementation-Version'.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to bypass certificate revocation checks, potentially enabling the use of revoked or compromised certificates. This may lead to unauthorized access, data breaches, or man-in-the-middle attacks if exploited.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized certificate validation bypasses. If an attacker exploits this flaw, they might bypass revocation checks for certificates, which could undermine secure communications and data integrity requirements mandated by these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Netty to version 4.1.136.Final or later, or 4.2.16.Final or later. If upgrading is not immediately possible, disable OCSP client functionality or implement additional validation checks for OCSP responses to ensure CertificateID matches the requested certificate.

Useful 0 Not Useful 0