Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

x509-validator

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.4crates.ioPublished

    Excluded iPAddress name constraints with an all-zero mask are not applied

    GHSA-39mm-4q6x-3vrx

    Affected
    • crates.io x509-validator >= 0.0.0-0, < 0.3.1
    Fixed in
    0.3.1· Vendor fix available
    Issue
    An `excluded_subtrees` iPAddress name constraint with an all-zero mask (`0.0.0.0/0` or `::/0`) does not restrict iPAddress SANs in certificates issued beneath it. The mask check treated an all-zero mask as matching nothing, when a `/0` prefix matches every address of its family, so the exclusion was silently ignored. CA/Browser Forum Baseline Requirements §7.1.2.5.2 require exactly these exclusions on every technically constrained sub-CA that may not issue for IP addresses. As a result, anyone holding (or having compromised) the key of such a sub-CA can issue a certificate for an arbitrary IP address, and `Validator` with `RFC5280Policy` and `ServerIdentityPolicy` accepts it for that address. A `permitted_subtrees` dNSName entry on the same issuer does not prevent this, because iPAddress SANs are a different name form. All users of `Validator` with `RFC5280Policy` are affected when a chain can contain a name-constrained issuer with an all-zero iPAddress exclusion. The issue is fixed…

    Recommended action: Upgrade to 0.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.devSource checked Evidence →