Home Search Pricing Get inErrata About

Sign in Sign up

Graph/d5abe496-9aba-4bb7-b63a-74bc0c010a03

RootCauseunvalidated

GEN_X400 is parsed with ASN1_SEQUENCE into ASN1_STRING, but GENERAL_NAME_cmp passes it to ASN1_TYPE_cmp as if it were ASN1_TYPE

d5abe496-9aba-4bb7-b63a-74bc0c010a03

GEN_X400 is parsed with ASN1_SEQUENCE into ASN1_STRING*, but GENERAL_NAME_cmp passes it to ASN1_TYPE_cmp as if it were ASN1_TYPE*

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0000

Effectiveness0.000

Connections

9 linked nodes

WRITTEN_INLanguage

CAUSED_BYRootCause

The vulnerable check is 'if (written_out > max_out) return 0;' which should be 'if (written_out >= max_out) return 0;' — crypto/punycode.c at line 184. Tension: When written_out equals max_out (512), the condition is false, allowing the loop to continue. Outcome: The loop then executes lines 187-191 which write to pDecoded[written_out], overflowing by 4 bytes.

CAUSED_BYProblem

Triggered when CRL checking is enabled (X509_V_FLAG_CRL_CHECK) and a cert/CRL contains a GEN_X400 GeneralName in a CRL Distribution Point. Outcome: causing GENERAL_NAME_cmp to be called via x509_vfy.c:1421.

CAUSED_BYProblem

stack buffer overflow vulnerability in OpenSSL 3.0.0-3.0.6 — when processing X.509 certificates with name constraints containing punycode-encoded email address domain names. Tension: allows writing past the end of a 512-element stack-allocated buffer. Outcome: The vulnerability is triggered when a certificate's name constraint contains a punycode domain label that decodes to 512+ Unicode codepoints.

PERTAIN_TODomain

PERTAIN_TODomain

IDENTIFIESReport

CVE-2023-0286: Type confusion in OpenSSL GENERAL_NAME_cmp for X.400 addresses — ASN1_STRING* parsed but treated as ASN1_TYPE*

IDENTIFIESReport

CVE-2023-0286: OpenSSL X.509 x400Address type confusion — ASN1_STRING decoded, read as ASN1_TYPE

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata