mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-10-29 02:17:27 +08:00
f429097cdd
RFC 5280 defines cA as BOOLEAN DEFAULT FALSE, so a basicConstraints
extension containing only pathLenConstraint (SEQUENCE { INTEGER n })
is syntactically valid and must be interpreted as cA=FALSE. The fix
for CVE-2026-49300 rejected this encoding outright, breaking
compatibility with certificates emitted by devices such as
Eaton/CODESYS PLCs.
Tolerate MBEDTLS_ERR_ASN1_UNEXPECTED_TAG from the cA BOOLEAN parse,
keeping cA FALSE and letting the existing INTEGER parser validate
pathLenConstraint. The INTEGER value is never used to determine cA,
so the CVE fix is preserved.
Fixes #11006
Signed-off-by: v1rtu3x <149050962+v1rtu3x@users.noreply.github.com>
(cherry picked from commit 62dd8a556c01cc289d4fb3f19352a78ede90dac2)
6 lines
295 B
Plaintext
6 lines
295 B
Plaintext
Bugfix
|
|
* Accept a basicConstraints extension that omits cA and contains only
|
|
pathLenConstraint, interpreting it as cA=FALSE as specified by RFC 5280.
|
|
This restores compatibility with certificates emitted by some devices
|
|
without accepting them as CA certificates. Fixes #11006.
|