dotnet / dotnet/dotnet-api-docs
Security Warning: API does not actually validate signature
- Dominant language
- C#
- Stars
- 949
- Forks
- 1.7k
- Avg merge
- 3d 27m
- Merged PRs (30d)
- 49
Description
The CreateFromSignedFile API does not validate that the file was actually properly signed by the certificate returned by this API, leading to security holes in products that assume that it validates the signature before returning the certificate. Callers should be warned about the need to call WinVerifyTrust to validate the signature on Windows (or implement an equivalent verification on non-Windows platforms).
https://twitter.com/tiraniddo/status/1072475737142239233
---
#### Document Details
⚠ *Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.*
* ID: 93f5be82-24e1-b5e3-bdd2-56184d07fdc7
* Version Independent ID: 7046cd3f-2dcc-02a3-0459-4bf5c7b5a19d
* Content: [X509Certificate.CreateFromSignedFile(String) Method (System.Security.Cryptography.X509Certificates)](https://docs.microsoft.com/en-us/dotnet/api/system.security.cryptography.x509certificates.x509certificate.createfromsignedfile?view=netframework-4.7.2)
* Content Source: [xml/System.Security.Cryptography.X509Certificates/X509Certificate.xml](https://github.com/dotnet/dotnet-api-docs/blob/master/xml/System.Security.Cryptography.X509Certificates/X509Certificate.xml)
* Product: **dotnet-api**
* GitHub Login: @dotnet-bot
* Microsoft Alias: **dotnetcontent**
Contributor guide
Assessment
This issue has not been assessed yet.