The vulnerability in rustls-webpki versions >=0.102.0-alpha.0 <0.103.10 and >=0.104.0-alpha.1 <0.104.0-alpha.5 is due to improper checking of certificate revocation. The CRL authority-matching logic only compares the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. This can be exploited by attackers with a compromised trusted issuing authority to present revoked certificates that bypass revocation checks under UnknownStatusPolicy::Allow or cause erroneous errors under the default deny policy.

An attacker who has compromised a trusted issuing authority can exploit this vulnerability to have revoked certificates accepted as valid under certain revocation check policies, potentially undermining the trust model of TLS connections using rustls-webpki. Under the default deny policy, the flaw may cause incorrect revocation errors, potentially disrupting legitimate connections.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor rustls project advisories for updates addressing this CRL authority-matching logic flaw. Until a fix is available, consider carefully the revocation policy settings and the trustworthiness of issuing authorities.