Threats affecting pkg:github/libressl/portable

LibreSSL's ocspcheck utility up to version 4.4.0 has a vulnerability where OCSP requests can be transmitted in cleartext when sent to HTTPS responder URLs on non-standard ports. This occurs because the function url2host() removes the OCSP URL scheme, and http_alloc() only uses TLS for port 443, leading to unencrypted transmission on other ports. As a result, on-path attackers can intercept OCSP requests and access sensitive certificate information such as serial numbers, issuer hashes, and nonces.

LibreSSL versions through 4.4.0 have a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions. This flaw allows attackers to inject carriage return and line feed characters into the OCSP POST request line by embedding them in a certificate's Authority Information Access OCSP URI. The vulnerability could enable injection of HTTP headers or splitting of requests sent to OCSP responders and proxies.