GHSA-69x3-g4r3-p962: Blocklist Bypass possible via ECDSA Signature Malleability

When using P256 certificates (which is not the default configuration), it is possible to evade a blocklist entry created against the fingerprint of a certificate by using ECDSA Signature Malleability to use a copy of the certificate with a different fingerprint.

In order for this to affect a user or network, all of the following must be true:

• CURVE_P256 certificates are being used
• There are one or more entries on the blocklist
• The certificates for those entries are signed by a trusted CA and not expired
• An attacker has a copy of the private key, and corresponding certificate, for one of those blocklist entries