Incorrect length validation on gnutls's gnutls_ocsp_resp_check_crt method can allow an attacker to use a OCSP response for a different certificate (but from the same CA) to continue using a revoked certificate. This can happen if the serial from the revoked certificate is a prefix of the other one, and the additional bytes happen to be equal on the system doing the verification.
Incorrect length validation on gnutls's gnutls_ocsp_resp_check_crt method can allow an attacker to use a OCSP response for a different certificate (but from the same CA) to continue using a revoked certificate. This can happen if the serial from the revoked certificate is a prefix of the other one, and the additional bytes happen to be equal on the system doing the verification.
https://gitlab.com/gnutls/gnutls/commit/964632f37dfdfb914ebc5e49db4fa29af35b1de9 https://lists.gnupg.org/pipermail/gnutls-devel/2016-September/008146.html
Vulmon