GHSA-g7hg-vrcf-mvmr — Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator

Affected: Maven: io.netty:netty-handler-ssl-ocsp

### Summary `OcspServerCertificateValidator` flags an out-of-date OCSP response but does not stop processing it, so an expired GOOD response is still reported as `VALID`, letting an on-path attacker replay a stale GOOD response to bypass revocation of a since-revoked certificate.

### Details In `io.netty.handler.ssl.ocsp.OcspServerCertificateValidator#userEventTriggered` the freshness check has no `return`, so execution falls through and a `VALID` `OcspValidationEvent` is still fired:

```java if (!(current.after(response.getThisUpdate()) && current.before(response.getNextUpdate()))) { ctx.fireExceptionCaught(new IllegalStateException("OCSP Response is out-of-date")); } ```

Nonce validation is optional and off by default, so freshness is the only replay defense — and it is not enforced. Additionally `getNextUpdate()` may be `null`, making `current.before(null)` throw `NullPointerException`.

https://datatracker.ietf.org/doc/html/rfc6960#section-3.2

``` 5. The time at which the status being indicated is known to be correct (thisUpdate) is sufficiently recent;

6. When available, the time at or before which newer information will be available about the status of the certificate (nextUpdate) is greater than the current time. ```

### PoC

Add the test below to `io.netty.handler.ssl.ocsp.OcspServerCertificateValidatorTest`

```java @Test…

Most recent entries from all

GHSA-g7hg-vrcf-mvmr — Netty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator