|
| 1 | +From 6d97029a7eff74a7ed5e695f192d106d1346130c Mon Sep 17 00:00:00 2001 |
| 2 | +From: Kanishk Bansal <kbkanishk975@gmail.com> |
| 3 | +Date: Tue, 4 Feb 2025 15:30:59 +0000 |
| 4 | +Subject: [PATCH] Address CVE-2024-45341 |
| 5 | + |
| 6 | +--- |
| 7 | + src/crypto/x509/name_constraints_test.go | 18 ++++++++++++++++++ |
| 8 | + src/crypto/x509/verify.go | 7 +++++-- |
| 9 | + 2 files changed, 23 insertions(+), 2 deletions(-) |
| 10 | + |
| 11 | +diff --git a/src/crypto/x509/name_constraints_test.go b/src/crypto/x509/name_constraints_test.go |
| 12 | +index 4c22c4c..78263fc 100644 |
| 13 | +--- a/src/crypto/x509/name_constraints_test.go |
| 14 | ++++ b/src/crypto/x509/name_constraints_test.go |
| 15 | +@@ -1599,6 +1599,24 @@ var nameConstraintsTests = []nameConstraintsTest{ |
| 16 | + cn: "foo.bar", |
| 17 | + }, |
| 18 | + }, |
| 19 | ++ |
| 20 | ++ // #86: URIs with IPv6 addresses with zones and ports are rejected |
| 21 | ++ { |
| 22 | ++ roots: []constraintsSpec{ |
| 23 | ++ { |
| 24 | ++ ok: []string{"uri:example.com"}, |
| 25 | ++ }, |
| 26 | ++ }, |
| 27 | ++ intermediates: [][]constraintsSpec{ |
| 28 | ++ { |
| 29 | ++ {}, |
| 30 | ++ }, |
| 31 | ++ }, |
| 32 | ++ leaf: leafSpec{ |
| 33 | ++ sans: []string{"uri:http://[2006:abcd::1%25.example.com]:16/"}, |
| 34 | ++ }, |
| 35 | ++ expectedError: "URI with IP", |
| 36 | ++ }, |
| 37 | + } |
| 38 | + |
| 39 | + func makeConstraintsCACert(constraints constraintsSpec, name string, key *ecdsa.PrivateKey, parent *Certificate, parentKey *ecdsa.PrivateKey) (*Certificate, error) { |
| 40 | +diff --git a/src/crypto/x509/verify.go b/src/crypto/x509/verify.go |
| 41 | +index 6efbff2..2d2a271 100644 |
| 42 | +--- a/src/crypto/x509/verify.go |
| 43 | ++++ b/src/crypto/x509/verify.go |
| 44 | +@@ -11,6 +11,7 @@ import ( |
| 45 | + "errors" |
| 46 | + "fmt" |
| 47 | + "net" |
| 48 | ++ "net/netip" |
| 49 | + "net/url" |
| 50 | + "reflect" |
| 51 | + "runtime" |
| 52 | +@@ -429,8 +430,10 @@ func matchURIConstraint(uri *url.URL, constraint string) (bool, error) { |
| 53 | + } |
| 54 | + } |
| 55 | + |
| 56 | +- if strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]") || |
| 57 | +- net.ParseIP(host) != nil { |
| 58 | ++ // netip.ParseAddr will reject the URI IPv6 literal form "[...]", so we |
| 59 | ++ // check if _either_ the string parses as an IP, or if it is enclosed in |
| 60 | ++ // square brackets. |
| 61 | ++ if _, err := netip.ParseAddr(host); err == nil || (strings.HasPrefix(host, "[") && strings.HasSuffix(host, "]")) { |
| 62 | + return false, fmt.Errorf("URI with IP (%q) cannot be matched against constraints", uri.String()) |
| 63 | + } |
| 64 | + |
| 65 | +-- |
| 66 | +2.43.0 |
| 67 | + |
0 commit comments