From 141c9b6015fc56cd05db3a853f08d03fcbd9b0f4 Mon Sep 17 00:00:00 2001 From: Alexander Sosedkin Date: Thu, 12 Mar 2026 09:48:57 +0100 Subject: [PATCH] cert-session: fix multi-entry OCSP revocation bypass In check_ocsp_response(), the code first searched for the SingleResponse that matches the certificate being validated. But later, the status was retrieved from entry 0 unconditionally, rather than from the matched resp_indx. As a result, if entry 0 corresponded to a different certificate and was good, while the matched entry for the peer certificate is revoked, the revocation check could've mistakenly accept the certificate. Reported-by: Oleh Konko (1seal) Reported-by: Joshua Rogers of AISLE Research Team Fixes: #1801 Fixes: #1812 Fixes: CVE-2026-3832 Fixes: GNUTLS-SA-2026-04-29-12 CVSS: 3.7 Low CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N Introduced-in: ae404fe8488dee424876b5963c00d7e041672415 3.8.9 CVE: CVE-2026-3832 Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/731861b9de8dccaf7d3b0c1446833051e48670c2] Signed-off-by: Alexander Sosedkin (cherry picked from commit 731861b9de8dccaf7d3b0c1446833051e48670c2) Signed-off-by: Deepak Rathore --- lib/cert-session.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/cert-session.c b/lib/cert-session.c index 963f797ee..f48c7a1fb 100644 --- a/lib/cert-session.c +++ b/lib/cert-session.c @@ -343,9 +343,9 @@ static int check_ocsp_response(gnutls_session_t session, gnutls_x509_crt_t cert, goto cleanup; } - ret = gnutls_ocsp_resp_get_single(resp, 0, NULL, NULL, NULL, NULL, - &cert_status, &vtime, &ntime, &rtime, - NULL); + ret = gnutls_ocsp_resp_get_single(resp, resp_indx, NULL, NULL, NULL, + NULL, &cert_status, &vtime, &ntime, + &rtime, NULL); if (ret < 0) { _gnutls_audit_log( session, -- 2.51.0