Threats affecting pkg:pypi/rfc3161-client

CVE-2026-33753 is an authorization bypass vulnerability in the rfc3161-client Python library prior to version 1.0.6. The flaw arises from improper certificate validation during signature verification, allowing an attacker to impersonate a trusted Time-Stamping Authority (TSA). This is achieved by exploiting a logic error in extracting the leaf certificate from an unordered PKCS#7 certificate bag, enabling the attacker to append a spoofed certificate that meets the required common_name and Extended Key Usage (EKU) criteria. The library then incorrectly validates authorization rules against the forged certificate while verifying the cryptographic signature against a legitimate TSA certificate, bypassing TSA authorization pinning. The vulnerability has a CVSS 3.1 score of 6.2 (medium severity) and is fixed in version 1.0.

rfc3161-client is a Python library implementing the Time-Stamp Protocol (TSP) described in RFC 3161. Prior to version 1.0.3, there is a flaw in the timestamp response signature verification logic. In particular, chain verification is performed against the TSR's embedded certificates up to the trusted root(s), but fails to verify the TSR's own signature against the timestamping leaf certificates. Consequently, vulnerable versions perform insufficient signature validation to properly consider a TSR verified, as the attacker can introduce any TSR signature so long as the embedded leaf chains up to some root TSA. This issue has been patched in version 1.0.3. There is no workaround for this issue.