Executive brief
The Apple App Store Server Python Library contains a security flaw in how it verifies the validity of digital certificates. The library fails to check if certificate status information is current, allowing an attacker to reuse old, expired 'good' status reports. This could allow a malicious actor to use a revoked or compromised certificate to sign data that the library will incorrectly trust, potentially leading to unauthorized transactions or data acceptance.
Technical details
The vulnerability exists in the `SignedDataVerifier` component of the `app-store-server-library` when `enable_online_checks=True`. Specifically, `_ChainVerifier.check_ocsp_status()` in `appstoreserverlibrary/signed_data_verifier.py` verifies the OCSP response signature and CertID but fails to validate the freshness window defined by the `producedAt`, `thisUpdate`, or `nextUpdate` fields. An attacker can perform a replay attack using a previously valid OCSP 'GOOD' response even after the certificate has been revoked. This allows JWS objects signed with revoked keys to be accepted as valid. The issue is addressed in version 3.1.2.
Affected products
- Apple app-store-server-library >= 0.2.0, <= 3.1.1
Timeline
- 2026-06-03: disclosed: Initial report to Apple repository
- 2026-07-13: advisory: GitHub Advisory published
- 2026-07-13: patched: Fix released in version 3.1.2