Netty's OcspClient Vulnerability: Potential Replay Attacks
An early warning has been issued regarding a potential vulnerability in Netty's OcspClient, which reportedly fails to validate the CertificateID in OCSP responses, potentially enabling replay attacks.
What happened
According to the advisory, Netty's OcspClient does not currently validate that the CertificateID in an OCSP response matches the requested CertificateID. This oversight appears to allow a bad actor to bypass revocation checks for any certificate by replaying a GOOD status response issued for an unrelated certificate.
This vulnerability, tracked as GHSA-272M-GCWP-MPWG, is under investigation. Software engineers using Netty should monitor for patches and be prepared to upgrade to a fixed version once it becomes available. The primary sources should be consulted for the most current information and recommendations.
As this is an early warning, the full scope and impact of the vulnerability are not yet confirmed. Engineers are advised to stay informed through official channels and apply patches as soon as they are released.
How 0Day mitigates this
netty is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.