Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

crypto/x509: CreateRevocationList() does not enforce that the CRL Number is at most 20 octets #53543

Closed
aarongable opened this issue Jun 24, 2022 · 2 comments
Closed

crypto/x509: CreateRevocationList() does not enforce that the CRL Number is at most 20 octets #53543

aarongable opened this issue Jun 24, 2022 · 2 comments
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Milestone
Backlog

Comments

@aarongable
Copy link
Contributor

aarongable commented Jun 24, 2022 •
edited

What version of Go are you using (go version)?

$ go version
go version go1.18.2 linux/amd64

Does this issue reproduce with the latest release?

Yes.

What did you do?

I created a CRL template containing a very large CRL Number. I passed this template to CreateRevocationList.

See https://go.dev/play/p/EcM1FoNQb_P for a running example.

What did you expect to see?

An error, because CreateRevocationList() says that it "creates a new X.509 v2 Certificate Revocation List, according to RFC 5280", but RFC 5280 says "Conforming CRL issuers MUST NOT use CRLNumber values longer than 20 octets.".

What did you see instead?

Success, and the creation of a CRL whose CRLNumber is longer than 20 octets.
@aarongable aarongable mentioned this issue Jun 24, 2022
Merged
@ianlancetaylor
Copy link
Contributor

CC @golang/security @rolandshoemaker

@ianlancetaylor ianlancetaylor added the NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. label Jun 24, 2022
@ianlancetaylor ianlancetaylor added this to the Backlog milestone Jun 24, 2022
@gopherbot
Copy link

Change https://go.dev/cl/415134 mentions this issue: crypto/x509: restrict CRL number to <=20 octets

jproberts pushed a commit to jproberts/go that referenced this issue Aug 10, 2022
@rolandshoemaker @jproberts
crypto/x509: restrict CRL number to <=20 octets
7475663 
Similar to certificate serial numbers, RFC 5280 restricts the length of
the CRL number field to no more than 20 octets. Enforce this in
CreateRevocationList.

Fixes golang#53543

Change-Id: If392ef6b0844db716ae9ee6ef317135fceab039c
Reviewed-on: https://go-review.googlesource.com/c/go/+/415134
Auto-Submit: Roland Shoemaker <roland@golang.org>
Reviewed-by: Tatiana Bradley <tatiana@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Run-TryBot: Roland Shoemaker <roland@golang.org>
@golang golang locked and limited conversation to collaborators Jul 7, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Milestone
Backlog
Development

No branches or pull requests
3 participants
@aarongable @ianlancetaylor @gopherbot