saltstack / saltstack/salt

[Bug]: `x509_v2` `basicConstraints` does not validate `pathlen` against issuer cert

Open
#70,042 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs-triage
Dominant language
Python
Stars
15.7k
Forks
5.6k
Avg merge
2d 44m
Merged PRs (30d)
80

Description

What happened?

When creating a CA certificate with a basicConstraints extension, salt.utils.x509._create_basic_constraints does not validate that an explicit pathlen is at most one lower than the one specified in the issuer certificate.

Also, if pathlen is not specified, it should default to pathlen_of_issuer - 1, while it currently issues a cert without one.

Type of salt install

Official deb

Major version

3006.x, 3007.x, 3008.x

What supported OS are you seeing the problem on? Can select multiple. (If bug appears on an unsupported OS, please open a GitHub Discussion instead)

ubuntu-24.04

salt --versions-report output
Latest HEAD of 3006.x

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at salt.utils.x509._create_basic_constraints and trace how the issuer certificate’s basicConstraints pathlen is read. Verify the behavior for an explicit pathlen and for an omitted pathlen, then add or update the relevant x509 tests so invalid limits are rejected and the derived limit is covered.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cryptography, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.