crypto/x509: ParseRevocationList accepts a GeneralName with an incorrect tag

[onepeople158]

Go version

go version go1.24.2 linux/amd64

Output of go env in your module/workspace:

IDP Extension Flags:
 Only Contains User Certificates: false
 Only Contains CA Certificates: false
 Indirect CRL: false
Tag: 5
gn.Bytes [134 23 104 116 116 112 115 58 47 47 119 119 119 46 101 120 97 109 112 108 101 46 99 111 109]
[Entry 1] Distribution Point URI: https://www.example.com

What did you do?

In this CRL file, the GeneralName in the fullName of the distributionPoint in the IDP extension is tagged as a context-specific tag and simple encoding, with the tag value set to 5. This violates the RFC5280 specification.However, when I use Go to parse this CRL file,Go successfully extracts the URI value from the GeneralName without any errors. Is this a bug, or is it a feature of Go?

What did you see happen?

Go parsed a GeneralName with an incorrect tag.

What did you expect to see?

go_main.zip

[gabyhelp]

Related Issues

• crypto/x509:Go accepts the IDP extension with DER encoding as an empty sequence. #73284

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}

[dmitshur]

CC @golang/security.