Fix indefinite length asn1 parsing #61
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
+1 for this fix! |
|
+1 |
g-k
approved these changes
Aug 26, 2021
There was a problem hiding this comment.
8d4fa5c from fullsailor#17 covers changes to ber.go
lgtm thank you!
| @@ -45,7 +47,8 @@ func TestBer2Der_Negatives(t *testing.T) { | |||
| {[]byte{0x30, 0x85}, "tag length too long"}, | |||
| {[]byte{0x30, 0x84, 0x80, 0x0, 0x0, 0x0}, "length is negative"}, | |||
| {[]byte{0x30, 0x82, 0x0, 0x1}, "length has leading zero"}, | |||
| {[]byte{0x30, 0x80, 0x1, 0x2}, "Invalid BER format"}, | |||
| {[]byte{0x30, 0x80, 0x1, 0x2, 0x1, 0x2}, "Invalid BER format"}, | |||
There was a problem hiding this comment.
| @@ -60,3 +63,124 @@ func TestBer2Der_Negatives(t *testing.T) { | |||
| } | |||
| } | |||
| } | |||
|
|
|||
| func TestBer2Der_NestedMultipleIndefinite(t *testing.T) { | |||
There was a problem hiding this comment.
👍 this test is also from the upstream commit
| iuZidpUfFhSk+Ls7TU/kB74ckfUGj5q/5HcKJgb/S+FYUV7eu0ewzTyW1uRl/d0U | ||
| Tb7e7EjgDGJsjOTMdTrMfv8ho8kAAAAAAAA= | ||
| -----END PKCS7----- | ||
| ` |
There was a problem hiding this comment.
Per openssl pkcs7 -print -inform pem -in this is an AWS PK7 doc:
PKCS7:
type: pkcs7-signedData (1.2.840.113549.1.7.2)
d.sign:
version: 1
md_algs:
algorithm: sha256 (2.16.840.1.101.3.4.2.1)
parameter: NULL
contents:
type: pkcs7-data (1.2.840.113549.1.7.1)
d.data:
0000 - 7b 22 41 67 65 6e 74 41-63 74 69 6f 6e 4f 76 {"AgentActionOv
000f - 65 72 72 69 64 65 73 22-3a 7b 22 41 67 65 6e errides":{"Agen
001e - 74 4f 76 65 72 72 69 64-65 73 22 3a 7b 22 46 tOverrides":{"F
002d - 69 6c 65 45 78 69 73 74-73 42 65 68 61 76 69 ileExistsBehavi
003c - 6f 72 22 3a 22 4f 56 45-52 57 52 49 54 45 22 or":"OVERWRITE"
004b - 7d 7d 2c 22 41 70 70 6c-69 63 61 74 69 6f 6e }},"Application
005a - 49 64 22 3a 22 65 30 34-34 32 33 65 34 2d 37 Id":"e04423e4-7
0069 - 61 36 37 2d 34 66 39 63-2d 62 32 39 31 2d 39 a67-4f9c-b291-9
0078 - 39 65 36 33 63 31 63 32-31 35 38 22 2c 22 41 9e63c1c2158","A
0087 - 70 70 6c 69 63 61 74 69-6f 6e 4e 61 6d 65 22 pplicationName"
0096 - 3a 22 6d 6b 61 6e 69 61-2d 78 72 64 5f 73 61 :"mkania-xrd_sa
00a5 - 6d 2e 63 64 77 73 5f 65-63 68 6f 73 65 72 76 m.cdws_echoserv
00b4 - 65 72 22 2c 22 44 65 70-6c 6f 79 6d 65 6e 74 er","Deployment
00c3 - 43 72 65 61 74 6f 72 22-3a 22 75 73 65 72 22 Creator":"user"
00d2 - 2c 22 44 65 70 6c 6f 79-6d 65 6e 74 47 72 6f ,"DeploymentGro
00e1 - 75 70 49 64 22 3a 22 66-61 62 39 32 31 30 66 upId":"fab9210f
00f0 - 2d 66 36 63 37 2d 34 32-38 35 2d 61 61 32 64 -f6c7-4285-aa2d
00ff - 2d 37 33 37 36 30 64 38-38 31 37 36 61 22 2c -73760d88176a",
010e - 22 44 65 70 6c 6f 79 6d-65 6e 74 47 72 6f 75 "DeploymentGrou
011d - 70 4e 61 6d 65 22 3a 22-6d 6b 61 6e 69 61 2d pName":"mkania-
012c - 78 72 64 5f 73 61 6d 2e-63 64 77 73 5f 65 63 xrd_sam.cdws_ec
013b - 68 6f 73 65 72 76 65 72-5f 64 67 22 2c 22 44 hoserver_dg","D
014a - 65 70 6c 6f 79 6d 65 6e-74 49 64 22 3a 22 64 eploymentId":"d
0159 - 2d 54 44 45 31 55 33 57-44 41 22 2c 22 44 65 -TDE1U3WDA","De
0168 - 70 6c 6f 79 6d 65 6e 74-54 79 70 65 22 3a 22 ploymentType":"
0177 - 49 4e 5f 50 4c 41 43 45-22 2c 22 47 69 74 48 IN_PLACE","GitH
0186 - 75 62 41 63 63 65 73 73-54 6f 6b 65 6e 22 3a ubAccessToken":
0195 - 6e 75 6c 6c 2c 22 49 6e-73 74 61 6e 63 65 47 null,"InstanceG
01a4 - 72 6f 75 70 49 64 22 3a-22 66 61 62 39 32 31 roupId":"fab921
01b3 - 30 66 2d 66 36 63 37 2d-34 32 38 35 2d 61 61 0f-f6c7-4285-aa
01c2 - 32 64 2d 37 33 37 36 30-64 38 38 31 37 36 61 2d-73760d88176a
01d1 - 22 2c 22 52 65 76 69 73-69 6f 6e 22 3a 7b 22 ","Revision":{"
01e0 - 41 70 70 53 70 65 63 43-6f 6e 74 65 6e 74 22 AppSpecContent"
01ef - 3a 6e 75 6c 6c 2c 22 43-6f 64 65 43 6f 6d 6d :null,"CodeComm
01fe - 69 74 52 65 76 69 73 69-6f 6e 22 3a 6e 75 6c itRevision":nul
020d - 6c 2c 22 47 69 74 48 75-62 52 65 76 69 73 69 l,"GitHubRevisi
021c - 6f 6e 22 3a 6e 75 6c 6c-2c 22 47 69 74 52 65 on":null,"GitRe
022b - 76 69 73 69 6f 6e 22 3a-6e 75 6c 6c 2c 22 52 vision":null,"R
023a - 65 76 69 73 69 6f 6e 54-79 70 65 22 3a 22 53 evisionType":"S
0249 - 33 22 2c 22 53 33 52 65-76 69 73 69 6f 6e 22 3","S3Revision"
0258 - 3a 7b 22 42 75 63 6b 65-74 22 3a 22 6d 6b 61 :{"Bucket":"mka
0267 - 6e 69 61 2d 63 64 77 73-2d 64 65 70 6c 6f 79 nia-cdws-deploy
0276 - 2d 62 75 63 6b 65 74 22-2c 22 42 75 6e 64 6c -bucket","Bundl
0285 - 65 54 79 70 65 22 3a 22-7a 69 70 22 2c 22 45 eType":"zip","E
0294 - 54 61 67 22 3a 6e 75 6c-6c 2c 22 4b 65 79 22 Tag":null,"Key"
02a3 - 3a 22 78 72 64 3a 3a 73-61 6d 2e 63 64 77 73 :"xrd::sam.cdws
02b2 - 3a 3a 65 63 68 6f 73 65-72 76 65 72 3a 3a 31 ::echoserver::1
02c1 - 3a 3a 2e 7a 69 70 22 2c-22 56 65 72 73 69 6f ::.zip","Versio
02d0 - 6e 22 3a 6e 75 6c 6c 7d-7d 2c 22 53 33 52 65 n":null}},"S3Re
02df - 76 69 73 69 6f 6e 22 3a-7b 22 42 75 63 6b 65 vision":{"Bucke
02ee - 74 22 3a 22 6d 6b 61 6e-69 61 2d 63 64 77 73 t":"mkania-cdws
02fd - 2d 64 65 70 6c 6f 79 2d-62 75 63 6b 65 74 22 -deploy-bucket"
030c - 2c 22 42 75 6e 64 6c 65-54 79 70 65 22 3a 22 ,"BundleType":"
031b - 7a 69 70 22 2c 22 45 54-61 67 22 3a 6e 75 6c zip","ETag":nul
032a - 6c 2c 22 4b 65 79 22 3a-22 78 72 64 3a 3a 73 l,"Key":"xrd::s
0339 - 61 6d 2e 63 64 77 73 3a-3a 65 63 68 6f 73 65 am.cdws::echose
0348 - 72 76 65 72 3a 3a 31 3a-3a 2e 7a 69 70 22 2c rver::1::.zip",
0357 - 22 56 65 72 73 69 6f 6e-22 3a 6e 75 6c 6c 7d "Version":null}
0366 - 2c 22 54 61 72 67 65 74-52 65 76 69 73 69 6f ,"TargetRevisio
0375 - 6e 22 3a 6e 75 6c 6c 7d- n":null}
cert:
cert_info:
version: 2
serialNumber: 8879827500985526912734396169086843076
signature:
algorithm: sha256WithRSAEncryption (1.2.840.113549.1.1.11)
parameter: NULL
issuer: C=US, O=Amazon, OU=Server CA 1B, CN=Amazon
validity:
notBefore: Nov 12 00:00:00 2020 GMT
notAfter: Oct 15 23:59:59 2021 GMT
subject: CN=codedeploy-signer-us-east-2.amazonaws.com
key:
algor:
algorithm: rsaEncryption (1.2.840.113549.1.1.1)
parameter: NULL
public_key: (0 unused bits)
0000 - 30 82 01 0a 02 82 01 01-00 e2 b7 87 fe 23 0............#
000e - 80 52 bf 8a c1 57 ff 1b-27 e7 f8 2a a0 70 .R...W..'..*.p
001c - 4c 2b 7d 88 97 9a bb fa-fd 96 24 1f 32 08 L+}.......$.2.
002a - ff 0b 53 36 13 e6 9a fb-eb bc 06 d6 3f 2d ..S6........?-
0038 - 0b 2d 07 8e 2f bf a2 aa-71 a8 8e c9 6a 64 .-../...q...jd
0046 - 0f d3 ac 52 dc bd a9 be-1e 35 33 c5 d9 8e ...R.....53...
0054 - 23 a4 db 22 fc 77 f0 d2-98 6c 77 d8 0b ba #..".w...lw...
0062 - 7d 9f a2 9a 48 2e 62 f8-95 92 06 94 18 53 }...H.b......S
0070 - 78 4c 2f ea a5 78 29 bc-97 38 6f 5a 6c 73 xL/..x)..8oZls
007e - 97 df 6f a3 54 5b 4c d6-b6 f3 1c d1 6f cf ..o.T[L.....o.
008c - dd 32 b1 f6 69 d7 a4 c1-02 2e c8 44 a1 19 .2..i......D..
009a - 79 7b dd 32 f9 49 24 c0-09 b4 0a 1b 97 18 y{.2.I$.......
00a8 - 83 21 2d c0 d5 cb 18 d4-6e 17 1d 81 13 f3 .!-.....n.....
00b6 - 12 28 0a 8a 77 9a a1 19-12 d0 31 51 43 f6 .(..w.....1QC.
00c4 - 7a 97 57 5d d8 43 d9 4d-06 ed a9 52 45 2e z.W].C.M...RE.
00d2 - 78 a3 dd 50 5b 50 e9 dc-0d 77 96 ed 40 d6 x..P[P...w..@.
00e0 - 77 6c f4 29 16 94 f9 03-4e 92 92 50 6f ea wl.)....N..Po.
00ee - 37 9c b9 fb a7 42 08 66-b2 76 02 f9 92 b3 7....B.f.v....
00fc - 2c 47 bf 5b 0a b4 75 b0-42 a6 e6 18 b5 02 ,G.[..u.B.....
010a - 03 01 00 01 ....
issuerUID: <ABSENT>
subjectUID: <ABSENT>
extensions:
object: X509v3 Authority Key Identifier (2.5.29.35)
critical: BOOL ABSENT
value:
0000 - 30 16 80 14 59 a4 66 06-52 a0 7b 95 92 0...Y.f.R.{..
000d - 3c a3 94 07 27 96 74 5b-f9 3d d0 <...'.t[.=.
object: X509v3 Subject Key Identifier (2.5.29.14)
critical: BOOL ABSENT
value:
0000 - 04 14 3c 5e 6a 4d b9 d3-0d 88 66 a7 bb ..<^jM....f..
000d - 46 9a 62 ff 8d 39 8b a0-73 F.b..9..s
object: X509v3 Subject Alternative Name (2.5.29.17)
critical: BOOL ABSENT
value:
0000 - 30 2b 82 29 63 6f 64 65-64 65 70 6c 6f 0+.)codedeplo
000d - 79 2d 73 69 67 6e 65 72-2d 75 73 2d 65 y-signer-us-e
001a - 61 73 74 2d 32 2e 61 6d-61 7a 6f 6e 61 ast-2.amazona
0027 - 77 73 2e 63 6f 6d ws.com
object: X509v3 Key Usage (2.5.29.15)
critical: TRUE
value:
0000 - 03 02 05 a0 ....
object: X509v3 Extended Key Usage (2.5.29.37)
critical: BOOL ABSENT
value:
0000 - 30 14 06 08 2b 06 01 05-05 07 03 01 06 0...+........
000d - 08 2b 06 01 05 05 07 03-02 .+.......
object: X509v3 CRL Distribution Points (2.5.29.31)
critical: BOOL ABSENT
value:
0000 - 30 32 30 30 a0 2e a0 2c-86 2a 68 74 74 0200...,.*htt
000d - 70 3a 2f 2f 63 72 6c 2e-73 63 61 31 62 p://crl.sca1b
001a - 2e 61 6d 61 7a 6f 6e 74-72 75 73 74 2e .amazontrust.
0027 - 63 6f 6d 2f 73 63 61 31-62 2e 63 72 6c com/sca1b.crl
object: X509v3 Certificate Policies (2.5.29.32)
critical: BOOL ABSENT
value:
0000 - 30 17 30 0b 06 09 60 86-48 01 86 fd 6c 0.0...`.H...l
000d - 01 02 30 08 06 06 67 81-0c 01 02 01 ..0...g.....
object: Authority Information Access (1.3.6.1.5.5.7.1.1)
critical: BOOL ABSENT
value:
0000 - 30 67 30 2d 06 08 2b 06-01 05 05 07 30 0g0-..+.....0
000d - 01 86 21 68 74 74 70 3a-2f 2f 6f 63 73 ..!http://ocs
001a - 70 2e 73 63 61 31 62 2e-61 6d 61 7a 6f p.sca1b.amazo
0027 - 6e 74 72 75 73 74 2e 63-6f 6d 30 36 06 ntrust.com06.
0034 - 08 2b 06 01 05 05 07 30-02 86 2a 68 74 .+.....0..*ht
0041 - 74 70 3a 2f 2f 63 72 74-2e 73 63 61 31 tp://crt.sca1
004e - 62 2e 61 6d 61 7a 6f 6e-74 72 75 73 74 b.amazontrust
005b - 2e 63 6f 6d 2f 73 63 61-31 62 2e 63 72 .com/sca1b.cr
0068 - 74 t
object: X509v3 Basic Constraints (2.5.29.19)
critical: TRUE
value:
0000 - 30 0
0002 - <SPACES/NULS>
object: undefined (1.3.6.1.4.1.11129.2.4.2)
critical: BOOL ABSENT
value:
0000 - 04 81 f2 00 f0 00 76 00-f6 5c 94 2f d1 ......v..\./.
000d - 77 30 22 14 54 18 08 30-94 56 8e e3 4d w0".T..0.V..M
001a - 13 19 33 bf df 0c 2f 20-0b cc 4e f1 64 ..3.../ ..N.d
0027 - e3 00 00 01 75 ba 1e 8c-87 00 00 04 03 ....u........
0034 - 00 47 30 45 02 20 7a aa-0a 5d b4 93 d7 .G0E. z..]...
0041 - b4 c2 13 33 35 04 c5 b1-fe 38 f2 55 05 ...35....8.U.
004e - 41 20 dd cb 1b 5e d4 e0-e6 95 df ae 02 A ...^.......
005b - 21 00 cf 51 22 59 84 99-bb ba a1 9e 6b !..Q"Y......k
0068 - af 95 c2 a7 83 7b fb c6-b8 64 ae 27 39 .....{...d.'9
0075 - 03 c1 32 0e 78 85 cf 68-00 76 00 5c dc ..2.x..h.v.\.
0082 - 43 92 fe e6 ab 45 44 b1-5e 9a d4 56 e6 C....ED.^..V.
008f - 10 37 fb d5 fa 47 dc a1-73 94 b2 5e e6 .7...G..s..^.
009c - f6 c7 0e ca 00 00 01 75-ba 1e 8c d4 00 .......u.....
00a9 - 00 04 03 00 47 30 45 02-20 10 a2 00 c3 ....G0E. ....
00b6 - 08 63 51 ca b6 8b 0c c1-01 a8 1d cb e7 .cQ..........
00c3 - d3 88 a9 c1 63 56 23 7f-ac 0e 79 1a 70 ....cV#...y.p
00d0 - 5d f3 02 21 00 bc c0 cd-e7 c6 25 ab 1a ]..!......%..
00dd - 02 29 77 3c e0 0e f1 61-65 94 d5 dc df .)w<...ae....
00ea - 35 25 67 18 02 ef ac ac-85 4e 85 5%g......N.
sig_alg:
algorithm: sha256WithRSAEncryption (1.2.840.113549.1.1.11)
parameter: NULL
signature: (0 unused bits)
0000 - 7a bf 64 9a 5e 77 5c 5c-b8 65 25 73 09 b7 6c z.d.^w\\.e%s..l
000f - 20 56 0f 3a 1b bb 2c 37-f9 89 f7 c7 05 56 45 V.:..,7.....VE
001e - 9c 63 84 54 e9 a2 3d 86-24 37 08 bd 47 a1 07 .c.T..=.$7..G..
002d - 21 86 80 b3 b1 bb 18 62-c2 a7 fe ad 75 cf 86 !......b....u..
003c - e1 e1 75 8f ac 01 22 49-97 65 cc 4c 4f 19 3f ..u..."I.e.LO.?
004b - f3 b4 7e 4b ed fa c8 32-e0 d4 60 59 be ab 6d ..~K...2..`Y..m
005a - 2d f7 b1 8f 44 d1 54 07-d5 2c 97 3b 16 32 d7 -...D.T..,.;.2.
0069 - 01 6d be c2 2e d8 c8 d7-bc 5f 5e e5 58 1c 07 .m......._^.X..
0078 - c5 ad 6b e4 a8 30 78 9b-21 1b 36 15 52 c8 0c ..k..0x.!.6.R..
0087 - 4d 2c 74 68 9f bd dd 99-ea a6 50 69 f7 1f bd M,th......Pi...
0096 - 0d 24 0d aa a3 65 06 0c-45 00 dc 6c bb 1f 9d .$...e..E..l...
00a5 - 7e 97 6e c8 b7 7c 54 ba-ad 94 40 86 0b 4e ed ~.n..|[email protected].
00b4 - 60 4e 26 05 a0 23 32 23-63 09 94 56 32 9f 32 `N&..#2#c..V2.2
00c3 - 6b f6 7a 27 f6 c9 67 6e-c8 0c 60 38 75 7c e6 k.z'..gn..`8u|.
00d2 - 97 d3 4d 9e 56 ee 50 30-1e 9c 00 72 52 a1 3e ..M.V.P0...rR.>
00e1 - d1 be fc 27 a1 26 99 d0-15 7f e3 7c b2 2a e2 ...'.&.....|.*.
00f0 - 32 0d 36 15 d3 f7 94 05-c9 2c 4f 2d 0d e6 69 2.6......,O-..i
00ff - f0 .
crl:
<EMPTY>
signer_info:
version: 1
issuer_and_serial:
issuer: C=US, O=Amazon, OU=Server CA 1B, CN=Amazon
serial: 8879827500985526912734396169086843076
digest_alg:
algorithm: sha256 (2.16.840.1.101.3.4.2.1)
parameter: NULL
auth_attr:
object: contentType (1.2.840.113549.1.9.3)
value.set:
OBJECT:pkcs7-data (1.2.840.113549.1.7.1)
object: signingTime (1.2.840.113549.1.9.5)
value.set:
UTCTIME:Jun 24 19:55:31 2021 GMT
object: undefined (1.2.840.113549.1.9.52)
value.set:
SEQUENCE:
0:d=0 hl=2 l= 30 cons: SEQUENCE
2:d=1 hl=2 l= 13 cons: SEQUENCE
4:d=2 hl=2 l= 9 prim: OBJECT :sha256
15:d=2 hl=2 l= 0 prim: NULL
17:d=1 hl=2 l= 13 cons: cont [ 1 ]
19:d=2 hl=2 l= 9 prim: OBJECT :sha256WithRSAEncryption
30:d=2 hl=2 l= 0 prim: NULL
object: messageDigest (1.2.840.113549.1.9.4)
value.set:
OCTET STRING:
0000 - fe e0 32 e4 f6 1f 4f c0-86 03 e0 8f 71 ..2...O.....q
000d - 28 d0 d5 82 21 d4 0e 06-32 4e d7 c7 28 (...!...2N..(
001a - 34 a2 1a 3a 72 58 4..:rX
digest_enc_alg:
algorithm: sha256WithRSAEncryption (1.2.840.113549.1.1.11)
parameter: NULL
enc_digest:
0000 - 95 fe 7b ce ea d1 8b d1-a2 7f 7f 10 d4 ef 13 ..{............
000f - 41 68 60 cc d8 6e 52 03-d9 17 9e 93 a2 f6 d7 Ah`..nR........
001e - b6 65 67 aa 54 b9 1b 1c-e2 08 61 27 96 21 59 .eg.T.....a'.!Y
002d - 97 8e 09 a2 f0 8b 89 ab-9d 0e 7f f8 31 8a 90 ............1..
003c - 9e 1a ff 0e 6c a8 54 f0-b4 92 06 20 80 2e 0c ....l.T.... ...
004b - 29 ff b8 39 bc 90 80 d4-56 46 de ce 74 8e 2e )..9....VF..t..
005a - 83 c0 eb b7 31 8a a8 08-76 a6 79 a6 a5 28 89 ....1...v.y..(.
0069 - dd 98 b0 38 f6 d2 8c 2b-18 31 b8 c1 41 7a 66 ...8...+.1..Azf
0078 - f8 4c f6 0f f9 bd ad c2-02 1c 6a bd 31 36 1f .L........j.16.
0087 - 08 e1 1d 37 f3 0a 09 7c-36 5b da 97 3e d8 c5 ...7...|6[..>..
0096 - 71 1f d9 c9 45 12 21 15-6b 57 d5 68 63 25 f6 q...E.!.kW.hc%.
00a5 - 90 b2 79 d0 26 4d f7 7a-86 88 af 72 90 2c a2 ..y.&M.z...r.,.
00b4 - 9b d7 7d 56 9a 69 1d b2-8a e6 62 76 95 1f 16 ..}V.i....bv...
00c3 - 14 a4 f8 bb 3b 4d 4f e4-07 be 1c 91 f5 06 8f ....;MO........
00d2 - 9a bf e4 77 0a 26 06 ff-4b e1 58 51 5e de bb ...w.&..K.XQ^..
00e1 - 47 b0 cd 3c 96 d6 e4 65-fd dd 14 4d be de ec G..<...e...M...
00f0 - 48 e0 0c 62 6c 8c e4 cc-75 3a cc 7e ff 21 a3 H..bl...u:.~.!.
00ff - c9 .
unauth_attr:
<EMPTY>
This was referenced Aug 26, 2021
|
Hi everyone, I tried to use the latest code but still hit a wall. What I see is that when I parse the message, I still only get the first 1000 bytes of the data, which I guess has to do witht he use of |
This was referenced Sep 8, 2021
jasonodonnell
pushed a commit
to hashicorp/vault
that referenced
this pull request
Sep 10, 2021
* Fix pkcs7 parsing in some cases brings in mozilla-services/pkcs7#61 from upstream In some cases but not all, aws includes a certificate in the pkcs7 response, and currently vault fails to parse those certificates: ``` URL: PUT https://vault.example.com/v1/auth/aws/login Code: 500. Errors * failed to parse the BER encoded PKCS#7 signature: ber2der: Invalid BER format ``` This fixes logins on those instances. Note we could not readily ascertain why some instances have those certificates and others don't. * Add changelog entry * Correct missed line
jasonodonnell
pushed a commit
to hashicorp/vault
that referenced
this pull request
Jan 31, 2022
* Fix pkcs7 parsing in some cases brings in mozilla-services/pkcs7#61 from upstream In some cases but not all, aws includes a certificate in the pkcs7 response, and currently vault fails to parse those certificates: ``` URL: PUT https://vault.example.com/v1/auth/aws/login Code: 500. Errors * failed to parse the BER encoded PKCS#7 signature: ber2der: Invalid BER format ``` This fixes logins on those instances. Note we could not readily ascertain why some instances have those certificates and others don't. * Add changelog entry * Correct missed line
jasonodonnell
added a commit
to hashicorp/vault
that referenced
this pull request
Feb 11, 2022
* Fix pkcs7 parsing in some cases brings in mozilla-services/pkcs7#61 from upstream In some cases but not all, aws includes a certificate in the pkcs7 response, and currently vault fails to parse those certificates: ``` URL: PUT https://vault.example.com/v1/auth/aws/login Code: 500. Errors * failed to parse the BER encoded PKCS#7 signature: ber2der: Invalid BER format ``` This fixes logins on those instances. Note we could not readily ascertain why some instances have those certificates and others don't. * Add changelog entry * Correct missed line Co-authored-by: Jacob Burroughs <[email protected]>
|
this change breaks parsing |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
cherry pick d25ebd6 from fullsailor/pkcs7
added test to decode pkcs7 from a well known service.