Threats affecting pkg:github/openbsd/src/usr.sbin/ocspcheck

LibreSSL ocspcheck versions through 4.4.0 have a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding carriage return and line feed sequences in a certificate's AIA OCSP URI path. This occurs because the function url2host() copies the URI path without filtering control characters, and http_open() includes this path in the POST request line, enabling header injection or request splitting to the OCSP responder.

LibreSSL ocspcheck versions up to 4.4.0 have a memory exhaustion vulnerability. Malicious OCSP responders can send unbounded HTTP responses, causing the ocspcheck process to consume excessive memory. This can lead to denial of service for certificate status checks when attackers control the responder or intercept unencrypted OCSP traffic.