mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-10-31 03:16:37 +08:00
62dd8a556c
RFC 5280 defines cA as BOOLEAN DEFAULT FALSE, so a basicConstraints
extension containing only pathLenConstraint (SEQUENCE { INTEGER n })
is syntactically valid and must be interpreted as cA=FALSE. The fix
for CVE-2026-49300 rejected this encoding outright, breaking
compatibility with certificates emitted by devices such as
Eaton/CODESYS PLCs.
Tolerate MBEDTLS_ERR_ASN1_UNEXPECTED_TAG from the cA BOOLEAN parse,
keeping cA FALSE and letting the existing INTEGER parser validate
pathLenConstraint. The INTEGER value is never used to determine cA,
so the CVE fix is preserved.
Fixes #11006
Signed-off-by: v1rtu3x <149050962+v1rtu3x@users.noreply.github.com>
|
||
|---|---|---|
| .. | ||
| .jenkins | ||
| configs | ||
| git-scripts | ||
| include/test | ||
| opt-testcases | ||
| scripts | ||
| src | ||
| suites | ||
| .gitignore | ||
| CMakeLists.txt | ||
| compat-in-docker.sh | ||
| compat.sh | ||
| context-info.sh | ||
| Descriptions.txt | ||
| make-in-docker.sh | ||
| Makefile | ||
| ssl-opt.sh | ||