Repository navigation
Release 1.4.3 - #1169
Merged
Merged
Release 1.4.3#1169
Conversation
- [ed25519] Reject small-order public keys in `ed25519.verify()`. Under such a key, signatures with `S = 0` and a small-order `R` verified for many or all messages without a private key. - Address GHSA-6889-vf6x-f3g5: - GHSA-6889-vf6x-f3g5 - Add submitted PoC. - Add tests.
Parse the id-ce-nameConstraints (2.5.29.30) extension into `permittedSubtrees` and `excludedSubtrees` and check the subject DN, subject emailAddress attributes and subjectAltName entries of each certificate (except self-issued intermediates) against the constraints of every certificate above it in the chain and of the trust anchor (RFC 5280 4.2.1.10, 6.1.3 (b) and (c), 6.1.4 (g)). Supported name types are rfc822Name, dNSName, directoryName, uniformResourceIdentifier and iPAddress. Constraints that cannot be evaluated fail closed with `unsupported_certificate`. A critical nameConstraints extension is no longer rejected as unsupported. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Changes on top of the submitted fix, checked against `openssl verify` (OpenSSL 3.5.5) on 62 curated chains and 2600 random constraint and name combinations, with no differences: - [x509] Check the commonName values of an end-entity certificate without a dNSName subjectAltName as dNSNames when they look like host names (OpenSSL `NAME_CONSTRAINTS_check_CN()`, `cn2dnsid()`). The submitted PoC leaf has only `CN=evil.com` and still verified. - [x509] Limit checking to 2^20 name and subtree comparisons per chain and fail with `unsupported_certificate` above it (OpenSSL limits names * subtrees to 2^20, `NAME_CHECK_MAX`). Names are checked before the CA above them is known to be trusted, and a self-made CA with 16000 excluded subtrees and a leaf with 16000 subjectAltNames (850 KB of PEM) blocked verification for 58 seconds. Collect the constraints for the chain in one list instead of copying them for each certificate, and lowercase and canonicalize names and subtrees once instead of on every comparison. - [x509] Don't throw while parsing a certificate with an invalid nameConstraints value; leave it unparsed. Chain verification always parses the value again and fails with `unsupported_certificate`. - [x509] Apply subtrees only to names of the same type (RFC 5280 4.2.1.10). An unsupported subtree, such as an otherName or one with a maximum, rejected every certificate below it, including TLS certificates under an AD CS "qualified subordination" CA that permits otherName UPNs and dNSNames. - [x509] Compare directoryName values ignoring ASCII case and extra whitespace (RFC 5280 7.1). `O=example` was not within `O=Example`, and `O=EVIL` was not within an excluded `O=Evil`. - [x509] Match an rfc822Name subtree `@host` against every mailbox on the host. It only matched an empty local part, so an excluded `@evil.com` excluded nothing. - [x509] Fail with `unsupported_certificate` for an rfc822Name without `@` or a URI without a host when there is a subtree of that type. They were accepted under excluded subtrees. - [x509] Check the names in every subjectAltName extension. - [x509] Rename the violation error's `name` property to `nameValue`. - Address GHSA-3cc4-3294-vgjf: - GHSA-3cc4-3294-vgjf - Add submitted PoC. - Add tests. - Document what `verifyCertificateChain()` checks.
- [tls] Ignore handshake messages received by a client without a session (before `handshake()`, or after `close_notify` or `close()`) instead of throwing a `TypeError` from `process()`. - Address GHSA-j8rw-jp99-435v: - GHSA-j8rw-jp99-435v - Add submitted PoC. - Add tests.
- [http] Trim header and cookie values with a loop instead of `/\s*$/`, which is quadratic on a long run of whitespace followed by another character. - Address GHSA-6cv4-p8m7-4r25: - GHSA-6cv4-p8m7-4r25 - Add tests.
- [tls] Fail a client handshake with an `illegal_parameter` alert when the ServerHello selects a compression method other than none, instead of throwing an uncaught `Error` at ServerHelloDone. - Address GHSA-w4xr-hqv8-ch44: - GHSA-w4xr-hqv8-ch44 - Add submitted PoC. - Add tests.
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1169 +/- ##
==========================================
+ Coverage 79.57% 80.11% +0.54%
==========================================
Files 43 43
Lines 10232 10528 +296
==========================================
+ Hits 8142 8435 +293
- Misses 2090 2093 +3
Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CHANGELOG.md.
when available.
nameConstraintsnot enforced in chain verificationforge.httpheader trimmingThe nameConstraints fix is two commits: the reporter's implementation and
a follow-up that brings it in line with OpenSSL. These changes affect
existing behavior (marked NOTE in the changelog):
fail.
names are within the constraints.
Thank you to the reporters; credits are in the changelog and advisories.