Netflix Lemur versions prior to 1.9.3 contain a TOCTOU race condition in the _validate_revocation_url function within lemur/certificates/verify.py. The function originally checked the Certificate Revocation List (CRL) or Online Certificate Status Protocol (OCSP) URLs but allowed HTTP redirects without validating each redirect target. This permitted attacker-controlled URLs to redirect to loopback, RFC1918, link-local, or instance metadata addresses. Separate DNS resolutions during validation and connection created a window for DNS rebinding attacks on both CRL and OCSP paths. An operator uploading a certificate via the POST /api/1/certificates/upload endpoint could trigger blind internal requests despite prior mitigations. The vulnerability is resolved in version 1.9.3 by disabling redirects and pinning validated IP addresses while maintaining the correct Host header value.

An attacker controlling a public URL used in certificate revocation checks can exploit the TOCTOU race condition to induce blind internal network requests from the Lemur service. This could lead to unauthorized access or information disclosure within internal or sensitive network segments. The vulnerability affects confidentiality, integrity, and availability to a limited extent, as reflected by the CVSS score of 6.3 (medium severity).

Upgrade Lemur to version 1.9.3 or later, where the vulnerability is fixed by disabling HTTP redirects during revocation URL validation and pinning validated IP addresses. Operators should ensure they do not use affected versions. No additional mitigations are indicated by the vendor advisory.