mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-10-28 18:07:34 +08:00
62dd8a556c
RFC 5280 defines cA as BOOLEAN DEFAULT FALSE, so a basicConstraints
extension containing only pathLenConstraint (SEQUENCE { INTEGER n })
is syntactically valid and must be interpreted as cA=FALSE. The fix
for CVE-2026-49300 rejected this encoding outright, breaking
compatibility with certificates emitted by devices such as
Eaton/CODESYS PLCs.
Tolerate MBEDTLS_ERR_ASN1_UNEXPECTED_TAG from the cA BOOLEAN parse,
keeping cA FALSE and letting the existing INTEGER parser validate
pathLenConstraint. The INTEGER value is never used to determine cA,
so the CVE fix is preserved.
Fixes #11006
Signed-off-by: v1rtu3x <149050962+v1rtu3x@users.noreply.github.com>
6 lines
295 B
Plaintext
6 lines
295 B
Plaintext
Bugfix
|
|
* Accept a basicConstraints extension that omits cA and contains only
|
|
pathLenConstraint, interpreting it as cA=FALSE as specified by RFC 5280.
|
|
This restores compatibility with certificates emitted by some devices
|
|
without accepting them as CA certificates. Fixes #11006.
|