The rfc3161-client Python library implements the Time-Stamp Protocol (TSP) as per RFC 3161. Versions prior to 1.0.6 contain a CWE-295 improper certificate validation vulnerability that allows an attacker to bypass authorization checks during signature verification. The vulnerability stems from a logic flaw in how the library extracts the leaf certificate from an unordered PKCS#7 certificate bag, permitting an attacker to insert a spoofed certificate with matching common_name and EKU attributes. This spoofed certificate passes authorization checks, while the cryptographic signature is validated against a genuine trusted TSA certificate, effectively bypassing TSA authorization pinning. This flaw enables impersonation of a trusted TSA, potentially undermining the trustworthiness of time-stamps generated using the library. The issue is resolved in version 1.0.6.

An attacker exploiting this vulnerability can impersonate a trusted Time-Stamping Authority by bypassing authorization checks in the rfc3161-client library. This could lead to acceptance of forged time-stamps, undermining the integrity and trust of time-stamping operations relying on this library. There is no reported impact on confidentiality or availability. No known exploits in the wild have been reported.

Upgrade rfc3161-client to version 1.0.6 or later, where this vulnerability is fixed. Patch status is not explicitly stated beyond this version update, so users should verify they are running 1.0.6 or newer. No other mitigations are indicated by the vendor advisory.