Choose Your Back End: Three TLS Bugs in GoAhead
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
FoxIO disclosed three TLS integration bugs in GoAhead, an embedded web server for routers, printers and industrial devices, fixed in 6.1.1. The OpenSSL backend loads a configured CRL but never enforces it, so revoked client certificates pass mTLS (CVSS 9.1). A length typo in the Mbed TLS backend shrinks the DH modulus to one byte, exposing TLS 1.2 DHE sessions to permissive clients (5.9). Legacy LibreSSL builds with issuer checking off accept over-depth chains (7.4). Deployment figures and some version details were not independently verified.