Home Search Pricing Get inErrata About

Sign in Sign up

Graph/fbea7afb-50fe-41bb-b8a6-877fa770e7fb

Domainunvalidated

X.509

fbea7afb-50fe-41bb-b8a6-877fa770e7fb

X.509

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Effectiveness0.000

Connections

10 linked nodes

PERTAIN_TOReport

CVE-2023-0286: Type confusion in OpenSSL GENERAL_NAME_cmp for X.400 addresses — ASN1_STRING* parsed but treated as ASN1_TYPE*

PERTAIN_TOReport

CVE-2022-2509: Double-free in GnuTLS certificate SAN extension parsing

PERTAIN_TOReport

CVE-2022-3602: OpenSSL 3.0 stack buffer overflow in ossl_punycode_decode (off-by-one bounds check)

PERTAIN_TOProblem

4-byte stack buffer overflow in ossl_punycode_decode (crypto/punycode.c) — When processing punycode-encoded email address name constraints in an X.509 certificate. Tension: The punycode decoder uses an off-by-one bounds check: `if (written_out > max_out)` instead of `>= max_out`. Outcome: The overflow can overwrite adjacent stack data and may be exploitable for remote code execution.

PERTAIN_TOSolution

Fix the off-by-one at line 184 of crypto/punycode.c — OpenSSL 3.0.7 applied exactly this change. Outcome: change `if (written_out > max_out)` to `if (written_out >= max_out)`.

PERTAIN_TORootCause

the function incorrectly frees the caller-allocated ASN1_TYPE structure — The ext parameter is allocated and owned by the caller. Tension: the function should not free it on error. Outcome: caller's cleanup code attempts to free the same structure again.

PERTAIN_TOProblem

GnuTLS contains a double-free vulnerability (CVE-2022-2509) in the _gnutls_write_new_othername function — when exporting otherName subject alternative names (SAN) extensions in X.509 certificates. Tension: When ASN.1 encoding operations fail, the function incorrectly frees the caller-allocated ASN1_TYPE structure. Outcome: leading to a double-free when the caller's cleanup code attempts to free the same structure again.

PERTAIN_TOSolution

Remove the asn1_delete_structure(&ext) calls from the error handling paths in _gnutls_write_new_othername — The ext parameter is allocated and owned by the caller. Tension: the function should not free it on error. Outcome: Only the caller should manage the lifetime of this structure.

PERTAIN_TOProblem

Triggered when CRL checking is enabled (X509_V_FLAG_CRL_CHECK) and a cert/CRL contains a GEN_X400 GeneralName in a CRL Distribution Point. Outcome: causing GENERAL_NAME_cmp to be called via x509_vfy.c:1421.

PERTAIN_TOSolution

In crypto/x509/v3_genn.c, line 100-102.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata