GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

The GoAhead embedded web server loaded a certificate revocation list into its default TLS backend but never turned revocation checking on, so a revoked client certificate could still pass login on affected setups. The flaw is in builds that use the OpenSSL backend with mutual-TLS, where the server checks a client certificate and vice versa, and a revocation list is configured to block revoked

The Hacker News에서 읽기

2026. 10. 27. 오후 10:59, The Hacker News에서 "GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption"을(를) 게시했습니다 (유형: 보안 뉴스). 관련 기술: OpenSSL.