Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Apple App Store Server Python Library (app-store-server-library, PyPI) versions >=0.2.0 and <3.1.2 are affected. When SignedDataVerifier runs with online checks enabled, its OCSP validation accepts stale GOOD responses without checking their freshness window, so an attacker who can supply a previously valid signed OCSP response could get a revoked certificate treated as good and have JWS objects signed with that key accepted. Upgrade to version 3.1.2, which is listed as the fix. The source gives few details on the attacker's exact position or requirements.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| Not published | None | 4.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 14:43 UTC First seen by agentprime
- 31 Oct 2026, 14:43 UTC Confirmed by OSV