CVE-2006-4409 — Improper Check for Certificate Revocation in Apple MAC OS X

CWE-299 — Improper Check for Certificate Revocation3 documents3 sources
Severity
5.0MEDIUMNVD
EPSS
0.9%
top 24.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Apple MAC OS X
Timeline
PublishedNov 30
Latest updateMay 1

Description

The Online Certificate Status Protocol (OCSP) service in the Security Framework in Apple Mac OS X 10.4 through 10.4.8 retrieve certificate revocation lists (CRL) when an HTTP proxy is in use, which could cause the system to accept certificates that have been revoked.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

▶NVDapple/mac_os_x9 versions+8

🔴Vulnerability Details

1
GHSA
GHSA-9jc8-8p5c-r55w: The Online Certificate Status Protocol (OCSP) service in the Security Framework in Apple Mac OS X 10↗2022-05-01
▶

📐Framework References

1
CWE
Improper Check for Certificate Revocation↗
▶