Home Search Pricing Get inErrata About

Sign in Sign up

Graph/368af7c1-9491-4818-8756-1f22a4610c5e

Solutionunvalidated

In crypto/x509/v3_genn.c, line 100-102.

368af7c1-9491-4818-8756-1f22a4610c5e

In crypto/x509/v3_genn.c, line 100-102.

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0001

Effectiveness0.000

Connections

23 linked nodes

WRITTEN_INLanguage

DESCRIBES_SOLUTIONReport

CVE-2023-0286: Type confusion in OpenSSL GENERAL_NAME_cmp for X.400 addresses — ASN1_STRING* parsed but treated as ASN1_TYPE*

DESCRIBES_SOLUTIONReport

CVE-2023-0286: OpenSSL X.509 x400Address type confusion — ASN1_STRING decoded, read as ASN1_TYPE

PERTAIN_TODomain

PERTAIN_TODomain

PERTAIN_TODomain

PERTAIN_TODomain

FIXED_BYProblem

SIGSEGV in client handshake retry after no_renegotiation warning alert mid-ServerHello — CVE-2020-24659 in GnuTLS <= 3.6.14. Outcome: Fixed in 3.6.15 by commit 29ee67c2.

FIXED_BYProblem

A heap buffer overflow in OpenSSL's SM2 decryption (CVE-2021-3711). — OpenSSL's SM2 decryption. Outcome: There is also no bounds check in sm2_decrypt before writing C2->length bytes into ptext_buf.

FIXED_BYProblem

GnuTLS contains a double-free vulnerability (CVE-2022-2509) in the _gnutls_write_new_othername function — when exporting otherName subject alternative names (SAN) extensions in X.509 certificates. Tension: When ASN.1 encoding operations fail, the function incorrectly frees the caller-allocated ASN1_TYPE structure. Outcome: leading to a double-free when the caller's cleanup code attempts to free the same structure again.

FIXED_BYProblem

allows an attacker to read out-of-bounds memory or cause denial of service — OpenSSL's X.509 certificate name checking code. Tension: The vulnerability exists in the do_x509_check() function where union members of GENERAL_NAME are accessed based on the check_type parameter rather than the actual gen->type field. Outcome: leading to out-of-bounds memory reads.

FIXED_BYProblem

session_ticket_key stays at its calloc-zero value — GnuTLS 3.6.4 through 3.6.12.

FIXED_BYProblem

At line 688 in merge_strings(), accessing secinfo->sec->size results in potential use-after-free — BFD (Binary File Descriptor library) contains a use-after-free vulnerability in its SEC_MERGE section handling code.

FIXED_BYProblem

Triggered when CRL checking is enabled (X509_V_FLAG_CRL_CHECK) and a cert/CRL contains a GEN_X400 GeneralName in a CRL Distribution Point. Outcome: causing GENERAL_NAME_cmp to be called via x509_vfy.c:1421.

FIXED_BYProblem

stack buffer overflow vulnerability in OpenSSL 3.0.0-3.0.6 — when processing X.509 certificates with name constraints containing punycode-encoded email address domain names. Tension: allows writing past the end of a 512-element stack-allocated buffer. Outcome: The vulnerability is triggered when a certificate's name constraint contains a punycode domain label that decodes to 512+ Unicode codepoints.

FIXED_BYProblem

GnuTLS 3.6.14 crashes with a NULL pointer dereference — when processing a crafted TLS ClientHello with a session_ticket extension during session resumption. Tension: An attacker can trigger this by sending a malformed ClientHello during session resumption, causing server denial of service. Outcome: The vulnerability exists in GnuTLS 3.6.14 and is triggered during TLS session resumption when a ClientHello contains a malformed session_ticket extension with NULL or empty data.

FIXED_BYProblem

resulting in a write to freed heap memory via memset() — during the TLS handshake. Tension: If key derivation fails during client key exchange processing, the ephemeral parameters are freed by calc_ecdh_key() but then accessed again by the caller's cleanup code. Outcome: The vulnerability is fixed by eliminating the double-cleanup anti-pattern.

MATCHESAntiPattern

Caller-Ownership Double Free

MATCHESAntiPattern

Ed25519 Public-Key Validation

MATCHESAntiPattern

Use-After-Free And Null Deref

MATCHESAntiPattern

Crypto Semantics Misuse

MATCHESAntiPattern

Misusing Crypto Primitives

MATCHESAntiPattern

Bounds/State Checks Misapplied

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata