CyberRota Analysis
AI-GeneratedThe vulnerability affects applications utilizing the OcspServerCertificateValidator in Netty versions prior to 4.1.136.Final and 4.2.16.Final, allowing an attacker to exploit expired OCSP responses to bypass certificate revocation. This can lead to the acceptance of revoked certificates, posing a significant security risk. Organizations using affected versions of Netty should prioritize upgrading to the patched versions to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, the OcspServerCertificateValidator flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as VALID, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate. Exploitation can lead to certificate revocation bypass via replay of an expired OCSP response. Any application using OcspServerCertificateValidator is affected; a revoked certificate can be accepted. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final.
Related CVEs
Other vulnerabilities affecting the same vendor(s)