{"action":"Upgrade app-store-server-library to 3.1.2 or later.","affected":[{"fixed":"3.1.2","introduced":"0.2.0"}],"component":"app-store-server-library","cve_ids":[],"ecosystem":"PyPI","exploited":false,"fixed_versions":["3.1.2"],"ghsa_id":"GHSA-8f6j-263m-g72x","id":"tcs_01M5KF80ZAFEZ4J6R8YEXT5JZ5","modified_at":"2026-07-14T00:00:09.283635125Z","published_at":"2026-07-13T23:49:14Z","references":["https://osv.dev/vulnerability/GHSA-8f6j-263m-g72x","https://github.com/apple/app-store-server-library-python/security/advisories/GHSA-8f6j-263m-g72x","https://github.com/apple/app-store-server-library-python"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-8f6j-263m-g72x","url":"https://osv.dev/vulnerability/GHSA-8f6j-263m-g72x"}],"summary":"Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checks"}