Описание
webpki: Name constraints were accepted for certificates asserting a wildcard name
Permitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.
This was incorrect because, given a name constraint of accept.example.com, *.example.com could feasibly allow a name of reject.example.com which is outside the constraint.
This is very similar to CVE-2025-61727.
Since name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.
Пакеты
Наименование
rustls-webpki
rust
Затронутые версииВерсия исправления
>= 0.101.0, < 0.103.12
0.103.12
Наименование
rustls-webpki
rust
Затронутые версииВерсия исправления
>= 0.104.0-alpha.1, < 0.104.0-alpha.6
0.104.0-alpha.6
2.2 Low
CVSS3
Дефекты
CWE-295
2.2 Low
CVSS3
Дефекты
CWE-295