Three TLS Bugs in GoAhead

Internet infrastructure companies using '5' as their private key are sweating bullets. They know they are next.

Oh boy. I wonder how many other companies that have previously been lax about validating that cert revocation is handled correctly by their devices are going to validate the eMudrha cert revocation and discover that they are not, in fact, handling revocation correctly. Yikes.

This is some serious severity inflation.

Skipping CRL checks is not a Critical. A Critical is "whoops we were not checking the signature on the certificates" or "I guess all zeroes is a fine session ticket key" (both happened, the former in wolfSSL, the latter in GnuTLS).

Bypassing chain length limits is... barely a Low? It's definitely not a High.

The DHE one is fun. It'd have been valuable if they spent some tokens figuring out if any open source library would accept those broken parameters. If not, it doesn't really matter. (Another good reason not to negotiate DH parameters ever!)

This caught my eye, remember how the eMudhra certificates had weirdly low parameters, like 4 and others in the single digits?

"Mbed TLS - Medium, CVSS 5.9 - A buffer-length typo reduces a 2048-bit DH modulus to one byte. TLS 1.2 DHE_RSA sessions are decryptable when the client accepts the broken parameters. GOAHEAD-SA-2026-0005."

Not familiar with those implementation details but was this the root cause?

How many of these bugs are just backdoors?

4!

Here we go again ... can we please just get through the month without breaking the internet?

4

[flagged]

[flagged]

nice i abs like this