Skip to content

Bugs filed for Firefox Certificate viewer on not strict enough parsing to of invalid certificates #425

@mb

Description

@mb

Hi, someone filed quite a few bugs in Firefox about the Firefox Certificate viewer accepting invalid certificates (bug list)

Firefox Certificate viewer uses PKI.js to parse the certificates and I was if you are interested in me filing bugs here for each case that was found or if summarizing them here in this issue would be good too and whether it is in scope of PKI.js to fix these discrepencies.

For example Bug 1870340:

For the DER-encoded digital certificates, if you want to represent 'Subject Type=CA' in the Basic Constraints, the correct content for the corresponding TLV structure should be '01 01 ff'. However, in our mutated certificate, we have mutated the '01 01 ff' node to '01 01 49'. But Firefox still interprets this incorrect data as 'Subject Type=CA', and it is unable to identify this data as incorrect.

Is there interest in filing bugs for these cases here? If so, how do you prefer me to move the reports here?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions