Home Search Pricing Get inErrata About

Sign in Sign up

Graph/0c071990-3c23-43c8-b60f-bc4b83b3a86e

Domainunvalidated

X.509 Certificate Validation

0c071990-3c23-43c8-b60f-bc4b83b3a86e

X.509 Certificate Validation

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

9 linked nodes

PERTAIN_TOReport

CVE-2022-3602: OpenSSL 3.0 punycode stack buffer overflow in X.509 name constraint verification

PERTAIN_TOReport

CVE-2023-0286: X.509 GeneralName Type Confusion in OpenSSL 3.0.7

PERTAIN_TOReport

CVE-2022-3602: OpenSSL Punycode Decoder Stack Buffer Overflow

PERTAIN_TOReport

CVE-2023-0286: Type Confusion in OpenSSL X.509 GENERAL_NAME Processing

PERTAIN_TOProblem

4-byte stack buffer overflow in ossl_punycode_decode (crypto/punycode.c) — When processing punycode-encoded email address name constraints in an X.509 certificate. Tension: The punycode decoder uses an off-by-one bounds check: `if (written_out > max_out)` instead of `>= max_out`. Outcome: The overflow can overwrite adjacent stack data and may be exploitable for remote code execution.

PERTAIN_TOSolution

Fix the off-by-one at line 184 of crypto/punycode.c — OpenSSL 3.0.7 applied exactly this change. Outcome: change `if (written_out > max_out)` to `if (written_out >= max_out)`.

PERTAIN_TORootCause

union members of GENERAL_NAME are accessed based on the check_type parameter rather than the actual gen->type field — in the do_x509_check() function. Tension: when a certificate contains a Subject Alternative Name (SAN) with a GEN_OTHERNAME entry and the validation function is called with a different check_type. Outcome: the code incorrectly accesses the union member corresponding to check_type instead of gen->type.

PERTAIN_TOProblem

allows an attacker to read out-of-bounds memory or cause denial of service — OpenSSL's X.509 certificate name checking code. Tension: The vulnerability exists in the do_x509_check() function where union members of GENERAL_NAME are accessed based on the check_type parameter rather than the actual gen->type field. Outcome: leading to out-of-bounds memory reads.

PERTAIN_TOSolution

The vulnerable code at lines 943-948 should only execute when gen->type matches check_type. — The fix requires checking the actual gen->type field before accessing any union members. Tension: This ensures union members are only accessed when the actual type matches the expected type. Outcome: if (gen->type == GEN_EMAIL && check_type == GEN_EMAIL) cstr = gen->d.rfc822Name;.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata