v1rtu3x f429097cdd x509: Accept basicConstraints with omitted cA ... RFC 5280 defines cA as BOOLEAN DEFAULT FALSE, so a basicConstraints extension containing only pathLenConstraint (SEQUENCE { INTEGER n }) is syntactically valid and must be interpreted as cA=FALSE. The fix for CVE-2026-49300 rejected this encoding outright, breaking compatibility with certificates emitted by devices such as Eaton/CODESYS PLCs. Tolerate MBEDTLS_ERR_ASN1_UNEXPECTED_TAG from the cA BOOLEAN parse, keeping cA FALSE and letting the existing INTEGER parser validate pathLenConstraint. The INTEGER value is never used to determine cA, so the CVE fix is preserved. Fixes #11006 Signed-off-by: v1rtu3x <149050962+v1rtu3x@users.noreply.github.com> (cherry picked from commit 62dd8a556c01cc289d4fb3f19352a78ede90dac2)		2026-10-21 12:55:10 +03:00
..
00README.md	scripts: fix paths for files moved to framework	2025-01-08 09:59:18 +01:00
cert-write-der-windows.txt	Add changelog for DER certificate output fix	2026-10-05 16:15:16 +05:30
cmake-config.txt	CMake: separate base config	2026-08-27 12:34:42 +02:00
numeric-oid-overflow.txt	Reject overflowing numeric OID components	2026-10-06 23:18:15 +03:00
serialized-data-load-hardening.txt	Reject out-of-bounds session ID length in ssl_tls12_session_load	2026-08-03 13:44:23 +05:30
ssl-context-load-alpn-bounds.txt	Reject out-of-bounds ALPN length in ssl_context_load	2026-10-04 22:44:49 +05:30
x509-basic-constraints-integer-first.txt	x509: Accept basicConstraints with omitted cA	2026-10-21 12:55:10 +03:00