Overview Five Name Constraints findings in BoringSSL (VU#410595.8–.12) describe cases where certificate names may not be constrained as intended. Records .8, .9, .10 and .12 concern the legacy crypto/x509 path; .11 concerns the newer pki path. Two have been fixed, one is accepted, one is disputed, and one was declined.
VU#410595: Google BoringSSL Name Constraints Bypass in SAN Validation Logic
About this summary. This is a short, independently written summary of an article first published by CERT/CC. Cyber Security News did not report or verify the underlying story. Read the original: https://kb.cert.org/vuls/id/410595
Source attribution: headline and facts are from CERT/CC (kb.cert.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Chrome Dev for Android Update
Hi everyone! We've just released Chrome Dev 158 (158.0.8106.0) for Android. It's now available on Google Play.
Chrome for Android Update
Hi, everyone! We've just released Chrome 155 (155.0.8059.84) for Android. It'll become available on Google Play over the next few days.
Chrome Beta for Android Update
Hi everyone! We've just released Chrome Beta 157 (157.0.8103.5) for Android. It's now available on Google Play.
Update Chrome: Google fixes 37 security flaws, including seven critical bugs
On October 13 and 14, Google issued several Chrome updates. Most users are on Chrome’s Stable channel. The desktop update brings Chrome to versions 155.0.8059.79/.80 for…
Chrome for Android Update
Hello Everyone! We've just released Chrome 156 (156.0.8078.39) for Android to a small percentage of users. It'll become available on Google Play over the next few days.
Chrome Beta for Android Update
Hi everyone! We've just released Chrome Beta 156 (156.0.8078.39) for Android. It's now available on Google Play.