Three TLS Bugs in GoAhead web server prior to 6.1.1

[Alan Coopersmith <alan.coopersmith () oracle com>]

EmbedThis GoAhead is an embeddable web server available under GPL or
commercial license (see https://github.com/embedthis/goahead ).

It can be compiled against a choice of TLS backends.

https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead
discloses vulnerabilities in the GoAhead code for three of those
backends: OpenSSL, LibreSSL, and Mbed TLS.

The TLDR section on that page says:
> GoAhead is used in hundreds of millions of IoT, Firewall, OT, and
> Military devices including those from Palo Alto Networks, Comcast,
> D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Digi,
> Lockheed Martin, Boeing, and more.
>
> Three independent bugs in GoAhead's TLS integrations can leave revoked
> client certificates accepted, encrypted sessions recoverable to an
> observer or a configured chain-depth limit unenforced. Exposure
> depends on the TLS library and the verification settings built into
> the device:
>
> * OpenSSL-compatible backend - Critical, CVSS 9.1 - CRL loaded but not
>   enforced, revoked client certificates are silently accepted.
>   GOAHEAD-SA-2026-0006.
>
> * LibreSSL legacy verifier - High, CVSS 7.4 - An over-depth client chain
>   is accepted when client certificates are required but issuer checking
>   is disabled. This bypasses the chain-depth restriction.
>   GOAHEAD-SA-2026-0004.
>
> * Mbed TLS - Medium, CVSS 5.9 - A buffer-length typo reduces a 2048-bit
>   DH modulus to one byte. TLS 1.2 DHE_RSA sessions are decryptable when
>   the client accepts the broken parameters. GOAHEAD-SA-2026-0005.
>
>
> TLS build:                      OpenSSL-compatible backend
> GoAhead versions:               >= 3.4.5, <= 6.1.0
> Required configuration:         mTLS enabled with a CRL configured. Revoked
>                                 client certificates remain accepted even with
>                                 issuer verification enabled.
> Fix or mitigation:              Upgrade to 6.1.1 or later.
>
>
> TLS build:                      Mbed TLS backend
> GoAhead versions:               >= 4.0.2, <= 6.1.0
> Required configuration:         TLS 1.2 DHE_RSA negotiated with a client
>                                 that accepts the broken DH parameters.
> Fix or mitigation:              Upgrade to 6.1.1 or later, disable finite-field
>                                 DHE suites, or use the OpenSSL backend.
>
>
> TLS build:                      LibreSSL legacy verifier — 3.2.x or 3.3.2–3.3.6
> GoAhead versions:               <= 6.1.0
> Required configuration:         VERIFY_PEER=1 and VERIFY_ISSUER=0.
>                                 An over-depth client chain is accepted.
> Fix or mitigation:              Enable VERIFY_ISSUER=1 with a trusted CA bundle,
>                                 or use OpenSSL / LibreSSL 4.x.



The web page then goes into much further detail I've not included here.

These seem to correspond to these GHSA advisories in their repo:

https://github.com/embedthis/goahead/security/advisories/GHSA-5m75-xq69-c3c5
 OpenSSL CRL loaded but not enforced in GoAhead sslOpen() (src/openssl.c):
 revoked client certificates are silently accepted

https://github.com/embedthis/goahead/security/advisories/GHSA-fmvx-2xfx-2gq4
 MbedTLS DH parameter truncation destroys forward secrecy: a length typo in
 sslOpen() (src/mbedtls.c) transmits a 1-byte DH modulus on TLS 1.2 DHE-RSA
 handshakes

https://github.com/embedthis/goahead/security/advisories/GHSA-r392-vqwx-3r4g
 mTLS client-certificate bypass: GoAhead's verifyClientCertificate() depth
 guard is skipped when the verifier reports a prior error, accepting an
 over-depth client chain on LibreSSL legacy-verifier builds

https://github.com/embedthis/goahead/security lists additional vulnerabilities
fixed in their 6.1.1 release.