mirror of
https://github.com/Mbed-TLS/mbedtls.git
synced 2026-10-28 18:07:34 +08:00
5af05a964a
RFC 5280 defines cA as BOOLEAN DEFAULT FALSE, so a basicConstraints
extension containing only pathLenConstraint (SEQUENCE { INTEGER n })
is syntactically valid and must be interpreted as cA=FALSE. The fix
for CVE-2026-49300 rejected this encoding outright, breaking
compatibility with certificates emitted by devices such as
Eaton/CODESYS PLCs.
Tolerate MBEDTLS_ERR_ASN1_UNEXPECTED_TAG from the cA BOOLEAN parse,
keeping cA FALSE and letting the existing INTEGER parser validate
pathLenConstraint. The INTEGER value is never used to determine cA,
so the CVE fix is preserved.
Fixes #11006
Signed-off-by: v1rtu3x <149050962+v1rtu3x@users.noreply.github.com>
(cherry picked from commit 62dd8a556c01cc289d4fb3f19352a78ede90dac2)
|
||
|---|---|---|
| .. | ||
| 00README.md | ||
| add-linkage-guard.txt | ||
| cert-write-der-windows.txt | ||
| cmake-config.txt | ||
| mbedtls_gcc_version.txt | ||
| musl_getrandom.txt | ||
| numeric-oid-overflow.txt | ||
| revert-rsa-keygen-hardening.txt | ||
| serialized-data-load-hardening.txt | ||
| sha256-update-ilen-over-4gib.txt | ||
| ssl-context-load-alpn-bounds.txt | ||
| x509-basic-constraints-integer-first.txt | ||