Online Certificate Stapling Protocol (OCSP) Revocation check bypass

LowPublished Oct 12, 2020

OCSP Verification Bypass in s2n_x509_validator_validate_cert_stapled_ocsp_response() If a private key has been inappropriately disclosed, a malicious server may trick an s2n client into accepting a revoked certificate that uses OCSP stapling as the only revocation mechanism, provided the certificate and key are otherwise valid. s2n clients supporting TLS 1.3 and below are affected. No AWS service was affected by this issue. s2n users should update to the latest version of s2n. AWS SDK users should use the latest versions of the AWS SDKs as a best practice. All versions of s2n from commit [https://github.com/awslabs/s2n/commit/e954e6eff49d08a4aeab69c13c299ca0a2c8d65f](https://github.com/awslabs/s2n/commit/e954e6eff49d08a4aeab69c13c299ca0a2c8d65f) through commit [https://github.com/awslabs/s2n/commit/0df8de3c5630357ed25b935a5978c63f49bb4108](https://github.com/awslabs/s2n/commit/0df8de3c5630357ed25b935a5978c63f49bb4108) are affected by this issue. Affected s2n users should fetch s2n commit [https://github.com/awslabs/s2n/commit/b74b95563b14d4db50b53c07a779527b729a672e](https://github.com/awslabs/s2n/commit/b74b95563b14d4db50b53c07a779527b729a672e).