12 lines
695 B
Text
12 lines
695 B
Text
|
Security
|
||
|
|
* Fix a compliance issue whereby we were not checking the tag on the
|
||
|
|
algorithm parameters (only the size) when comparing the signature in the
|
||
|
|
description part of the cert to the real signature. This meant that a
|
||
|
|
NULL algorithm parameters entry would look identical to an array of REAL
|
||
|
|
(size zero) to the library and thus the certificate would be considered
|
||
|
|
valid. However, if the parameters do not match in *any* way then the
|
||
|
|
certificate should be considered invalid, and indeed OpenSSL marks these
|
||
|
|
certs as invalid when mbedtls did not.
|
||
|
|
Many thanks to guidovranken who found this issue via differential fuzzing
|
||
|
|
and reported it in #3629.
|