Skip to content

Gnutls no longer accepts certificates whose notbefore field is a non-digits string

llqll requested to merge llqll/gnutls:issue-870 into master

issues #870 (closed) describes gnutls accepting a certificate whose notbefore field is a non-digits string. According to RFC5280, gnutls should reject such certificates. the time in the certificate must be a string of numbers.

To solve the issue,add a check for the value of the notbefore or notafter field in the function _gnutls_utcTime2gtime. check whether the value of the notbefore or notafter field contains non-digits characters, and reject certificates whose notbefore or notafter include non-digits characters.

We also add file tests/cert-tests/cert-non-digits-time. This file is used to check if gnutls accepts a certificate whose time field is a non-digits string. this issue was found by our semantic differential fuzzer.

Resolves: #870 (closed)

image text

Checklist

  • Commits have Signed-off-by: with name/author being identical to the commit author
  • Code modified for feature
  • Test suite updated with functionality tests
  • Test suite updated with negative tests
  • Documentation updated / NEWS entry present (for non-trivial changes)
  • CI timeout is 2h or higher (see Settings/CICD/General pipelines/Timeout)

Reviewer's checklist:

  • Any issues marked for closing are addressed
  • There is a test suite reasonably covering new functionality or modifications
  • Function naming, parameters, return values, types, etc., are consistent and according to CONTRIBUTION.md
  • This feature/change has adequate documentation added
  • No obvious mistakes in the code
Edited by llqll

Merge request reports