]> Cypherpunks repositories - gostls13.git/commit
crypto/x509: rework fix for CVE-2025-58187
authorRoland Shoemaker <roland@golang.org>
Thu, 9 Oct 2025 20:35:24 +0000 (13:35 -0700)
committerRoland Shoemaker <roland@golang.org>
Sat, 11 Oct 2025 23:12:44 +0000 (16:12 -0700)
commit1cd71689f2ed8f07031a0cc58fc3586ca501839f
tree20cb93806f8e0f61ea31301bdcf2ded999ed1b82
parent8aa1efa223d7bd39faaabdfbf85882ed3942a6f4
crypto/x509: rework fix for CVE-2025-58187

In CL 709854 we enabled strict validation for a number of properties of
domain names (and their constraints). This caused significant breakage,
since we didn't previously disallow the creation of certificates which
contained these malformed domains.

Rollback a number of the properties we enforced, making domainNameValid
only enforce the same properties that domainToReverseLabels does. Since
this also undoes some of the DoS protections our initial fix enabled,
this change also adds caching of constraints in isValid (which perhaps
is the fix we should've initially chosen).

Updates #75835
Fixes #75828

Change-Id: Ie6ca6b4f30e9b8a143692b64757f7bbf4671ed0e
Reviewed-on: https://go-review.googlesource.com/c/go/+/710735
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>
src/crypto/x509/name_constraints_test.go
src/crypto/x509/parser.go
src/crypto/x509/parser_test.go
src/crypto/x509/verify.go
src/crypto/x509/verify_test.go