When parsing a certificate that contains iPAddress excludedSubtrees, we store the base address in its unmasked form.
If the base address has bits which should be masked (e.g. 10.10.10.10/16) this can break our binary search comparator when the IP being searched for is between the masked and unmasked base addresses, which can result in a matching excluding subtree not being correctly surfaced.
Exploiting this would require a misbehaving or malicious CA which issues a certificate with an iPAddress SAN which its parents explicitly disallow, so we are treating this as a security hardening issue, instead of a security issue per the Go Security Policy.
This issue was originally reported to security@golang.org by p4p3r of CYBERONE — https://hackerone.com/p4p3r_hak.
When parsing a certificate that contains iPAddress excludedSubtrees, we store the base address in its unmasked form.
If the base address has bits which should be masked (e.g.
10.10.10.10/16) this can break our binary search comparator when the IP being searched for is between the masked and unmasked base addresses, which can result in a matching excluding subtree not being correctly surfaced.Exploiting this would require a misbehaving or malicious CA which issues a certificate with an iPAddress SAN which its parents explicitly disallow, so we are treating this as a security hardening issue, instead of a security issue per the Go Security Policy.
This issue was originally reported to security@golang.org by p4p3r of CYBERONE — https://hackerone.com/p4p3r_hak.