Three TLS Bugs in GoAhead

GoAhead, a web server embedded in large numbers of IoT, industrial, firewall, and other devices, has three TLS defects whose impact depends on its cryptographic backend and configuration. With the OpenSSL-compatible backend, GoAhead loads certificate revocation lists but does not enable OpenSSL’s CRL-checking flags, so revoked client certificates can still pass mutual TLS authentication. This affects versions 3.4.5-6.1.0 when a CRL is configured, with the clearest risk when peer and issuer verification are enabled; it is rated critical. In the mbed TLS backend, a length typo makes a 2048-bit Diffie-Hellman modulus appear to be one byte long. A passive observer can then test a handful of possible shared secrets and decrypt captured TLS 1.2 DHE_RSA sessions, provided the client accepts the invalid parameters. ECDHE and TLS 1.3 are unaffected.

The third defect affects legacy LibreSSL verification: when client certificates are required but issuer checking is disabled, an overlong certificate chain can be accepted despite GoAhead’s configured depth limit. LibreSSL reports an issuer error rather than a depth error, and GoAhead’s policy accepts that error. The issue is rated high; the supplied account identifies affected LibreSSL builds but does not give their version range. GoAhead 6.1.1 fixes the OpenSSL and mbed TLS bugs by enabling CRL checks and passing the modulus’s correct length, and also addresses the reported TLS issues. Device operators should identify the TLS backend and verification settings in use, and check network fingerprints for TLS 1.2 DHE_RSA suites when assessing mbed TLS exposure.