diff options
| author | Tobias Nießen <tniessen@tnie.de> | 2021-12-30 03:30:57 +0300 |
|---|---|---|
| committer | Richard Lau <rlau@redhat.com> | 2022-01-07 18:56:45 +0300 |
| commit | df1b2c33f6b5dec388858a1e700619596c788969 (patch) | |
| tree | a52f2c30f603fee6f0a4a7295cfc8a9c917a2d33 /doc | |
| parent | b14be42518f72f97c46f6e16772ab27a5e9554e0 (diff) | |
crypto,tls: implement safe x509 GeneralName format
This change introduces JSON-compatible escaping rules for strings that
include X.509 GeneralName components (see RFC 5280). This non-standard
format avoids ambiguities and prevents injection attacks that could
previously lead to X.509 certificates being accepted even though they
were not valid for the target hostname.
These changes affect the format of subject alternative names and the
format of authority information access. The checkServerIdentity function
has been modified to safely handle the new format, eliminating the
possibility of injecting subject alternative names into the verification
logic.
Because each subject alternative name is only encoded as a JSON string
literal if necessary for security purposes, this change will only be
visible in rare cases.
This addresses CVE-2021-44532.
Co-authored-by: Akshay K <iit.akshay@gmail.com>
CVE-ID: CVE-2021-44532
Backport-PR-URL: https://github.com/nodejs-private/node-private/pull/305
PR-URL: https://github.com/nodejs-private/node-private/pull/300
Reviewed-By: Michael Dawson <midawson@redhat.com>
Reviewed-By: Rich Trott <rtrott@gmail.com>
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/api/errors.md | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/doc/api/errors.md b/doc/api/errors.md index 7abf3a8fe0f..fc30497feaf 100644 --- a/doc/api/errors.md +++ b/doc/api/errors.md @@ -1975,6 +1975,14 @@ An unspecified or non-specific system error has occurred within the Node.js process. The error object will have an `err.info` object property with additional details. +<a id="ERR_TLS_CERT_ALTNAME_FORMAT"></a> +### `ERR_TLS_CERT_ALTNAME_FORMAT` + +This error is thrown by `checkServerIdentity` if a user-supplied +`subjectaltname` property violates encoding rules. Certificate objects produced +by Node.js itself always comply with encoding rules and will never cause +this error. + <a id="ERR_TLS_CERT_ALTNAME_INVALID"></a> ### `ERR_TLS_CERT_ALTNAME_INVALID` |