Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix crash due to X.509 certificates with Subject Alternative Name other than DNS Host #3397

Closed
wants to merge 8 commits into from

Conversation

echo-branch
Copy link

This PR fixes #3221.

Modified X509Certificate.cpp to skip Subject Alternative Name entries other than DNS Host. This fixes a crash.

Modified SecureSocketImpl.cpp to fix an error check issue. The comment indicates the code should have ignored errors other than CRYPT_E_REVOKED, however revStat.dwIndex < certs.size() - 1 is true when you have any error.

@echo-branch
Copy link
Author

echo-branch commented Sep 7, 2021

@obiltschnig
Hi, just curious if the 1.11.1 release is going to hit its target release date, September 13, 2021. We would rather use an official release, rather than patched version.

@echo-branch
Copy link
Author

Just want to share detailed repro steps with Kaspersky. Though any X.509 certificate with SAN entries other than DNS Host will also repro the issue.

  1. Install Kaspersky Total Security for Windows. The California binary is fine.
  2. Open the Kaspersky "Settings" and navigate to the "Network settings".
  3. Under "Encrypted connection scanning" select "Always scan encrypted connections"
  4. Network calls crash due to the SAN "IP Address" entry in Kaspersky's certificate.

@obiltschnig
Copy link
Member

See 270c264

@obiltschnig obiltschnig closed this Nov 5, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Crash reported on Windows in X509Certificate verification
2 participants