PT-2026-104136 · Bc-Csharp · Bc-Csharp
CVSS v4.0
8.2
عالية
| المتجه | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
bc-csharp versions prior to 2.7.0
Description
Improper certificate validation occurs during the directoryName name-constraint check within the
PkixNameConstraintValidator.WithinDNSubtree function. An attacker controlling a name-constrained intermediate CA can bypass PKIX path validation by using a name that places other Relative Distinguished Names (RDNs) before a copy of the permitted RDN sequence. This happens because the validation process searches for the constraint's first RDN anywhere in the name and compares subsequent RDNs from that point, rather than ensuring the constraint is an initial prefix of the name as required by RFC 5280.Recommendations
Update to version 2.7.0 or later.
استغلال
إصلاح
Improper Certificate Validation
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Bc-Csharp