Choose Your Backend: Three TLS Bugs in GoAhead
Summary
The article analyzes three TLS-related bugs in GoAhead across its TLS backends (OpenSSL-compatible, Mbed TLS, and LibreSSL): a CRL enforcement defect that allows revoked certificates to pass mTLS, a DH parameter truncation bug in the Mbed TLS backend enabling potential session decryption, and a legacy LibreSSL verifier behavior that can bypass chain-depth checks. It lists affected versions, provides fixes in GoAhead 6.1.1, and offers detection guidance via JA4Scan fingerprints and a PoC, along with references and remediation steps.