- Reported
-
- Issued
-
- Package
-
rustls-webpki
(crates.io)
- Type
-
Vulnerability
- Categories
-
- Keywords
-
#crl
#certificate-revocation-list
#x509
- Aliases
-
- Patched
-
>=0.103.13, <0.104.0-alpha.1>=0.104.0-alpha.7
Description
A panic was reachable when parsing certificate revocation lists via [BorrowedCertRevocationList::from_der]
or [OwnedCertRevocationList::from_der]. This was the result of mishandling a syntactically valid empty
BIT STRING appearing in the onlySomeReasons element of a IssuingDistributionPoint CRL extension.
This panic is reachable prior to a CRL's signature being verified.
Applications that do not use CRLs are not affected.
Thank you to @tynus3 for the report.
Advisory available under CC0-1.0
license.