3 ms·
Well, it also seems to require that you completely ignore the trust chain? Am I reading that right? > Note that this occurs after certificate chain signature
by couchand 4y ago
Well, it also seems to require that you completely ignore the trust chain? Am I reading that right?
> Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer.
- NovemberWhiskey 4y agoThe point is the vulnerable code will execute any time a trusted certificate is being validated. If you have a service that depends on mTLS, then your service is (by definition) validating client certificates so you can't mitigate your exposure. There is a separable question of whether your service trusts certificates issued by a CA that might produce a certificate with a SAN of the necessary form to trigger the exploit.
- couchand 4y agoIf you rely on mTLS you highly likely run your own CA. You can probably say with confidence that no malicious certificates have been signed by your CA. So you mitigate your exposure by ignoring certs without a valid chain of trust, which you're doing anyway. Am I missing something?