The Apple App Store Server Python Library's SignedDataVerifier component improperly validates OCSP responses by accepting stale 'GOOD' responses indefinitely. This flaw allows replay of expired OCSP responses, bypassing certificate revocation checks. Applications using this library with online checks enabled may continue to trust revoked certificates if a stale OCSP response is replayed. The vulnerability affects versions from 0.2.0 up to but not including 3.1.2. No patch information is currently provided.