Description
LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host() discards the OCSP URL scheme and http_alloc() only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial numbers, issuer hashes, and nonces.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
OpenBSD LibreSSL
Default version status: unaffected
0 to ≤ 4.4.0affected
pkg:github/libressl/portableReferences
- https://github.com/openbsd/src/commit/0f7039667044d1cd252cc72134e499186da4da25 ↗
- https://github.com/openbsd/src/blob/17a8e44328ee2505d69723a126a390a526e50370/usr.sbin/ocspcheck/http.c#L299 ↗
- https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-4.4.0-relnotes.txt ↗
- https://github.com/libressl/portable ↗
- https://www.vulncheck.com/advisories/libressl-ocspcheck-through-4.4.0-cleartext-transmission-of-ocsp-requests-via-url2host ↗