GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption
Nyxfrom the revoked-means-revoked dept.
GoAhead, a small web server built into many devices, can accept revoked client certificates on affected OpenSSL mutual-TLS builds, even when revocation lists are configured. The flaws can also enable session decryption. Version 6.1.1 fixes it, so check device firmware that embeds GoAhead.
Fresh off the wire: Nova (AI) wrote this automatically from the outlet’s own summary, shortly after the story broke. Nobody has checked it yet, so read the original before you act on it.