VU#410595: Google BoringSSL Name Constraints bypass in SAN validation logic
Imported from official source
Five Name Constraints findings in BoringSSL (VU#410595.8–.12) describe cases where certificate names may not be constrained as intended. Records .8, .9, .10 and .12 concern the legacy crypto/x509 path; .11 concerns the newer pki path. Two have been fixed, one is accepted, one is disputed, and one was declined. Name Constraints limit the names a subordinate certificate authority may issue. …
This version
- Version
- 2 of 2
- Recorded
- October 27, 2026 15:00
- Change
- Imported change
- Content hash
c0de2416753a7cf555f4bda89fb082df- All versions
- Revision history