Threats tagged 'ghsa-p83x-c6v7-9mxw'

LibreSSL versions through 4.4.0 have a CRLF injection vulnerability in the libcrypto OCSP_sendreq_new() and OCSP_parse_url() functions. This flaw allows attackers to inject carriage return and line feed characters into the OCSP POST request line by embedding them in a certificate's Authority Information Access OCSP URI. The vulnerability could enable injection of HTTP headers or splitting of requests sent to OCSP responders and proxies.