Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD…
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-295.
Summary
### Summary `SignedDataVerifier` attempts to perform online revocation checking when `enable_online_checks=True`, but its OCSP validation logic accepts stale `GOOD` responses as valid indefinitely. In `appstoreserverlibrary/signed_data_verifier.py`, `_ChainVerifier.check_ocsp_status()` verifies the OCSP response signature and CertID match, but never validates the freshness window carried by `producedAt`, `thisUpdate`, or `nextUpdate`. As a result, a previously valid signed OCSP `GOOD` response can be replayed after it is expired, and the library will still treat the certificate as good. If an App Store signing certificate or intermediate is ever revoked, applications using this library with online checks enabled can continue accepting JWS objects signed with the revoked key as long as a stale signed OCSP response is replayed.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | app-store-server-library (PyPI) | 0.2.0 to before 3.1.2 | 3.1.2 | Patch available | GHSA-8f6j-263m-g72x |
- app-store-server-library (PyPI) Vendor— Affected 0.2.0 to before 3.1.2 Fixed in 3.1.2 Patch available GHSA-8f6j-263m-g72x
Remediation
- Fix · GHSA-8f6j-263m-g72x app-store-server-library (PyPI) Fixed in 3.1.2 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-8f6j-263m-g72x
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences