tmp_crl_issuer not checked if it is None
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 115
- Forks
- 34
- PR merge metrics
- No merged PRs in 30d
Description
The result from certificate_registry.retrieve_by_key_identifier(certificate_list.authority_key_identifier) (lines 1304 to 1306) is not validated before the subject property is called:
I am calling verify_crl directly on some very broken SSL/TLS cert chains, so I can understand that I am using verify_crl out of the expected context, which is probably why I am encountering this problem. On the other hand, I think it would be fairly trivial to check that tmp_crl_issuer is not None before retrieving the subject property (or just continuing the loop if tmp_crl_issuer is None).
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in validate.py around lines 1304-1307, where verify_crl retrieves the CRL issuer and accesses its subject. Trace the direct verify_crl path with a broken certificate chain and confirm that a missing issuer no longer causes an attribute error. Done means the None case is handled without disrupting valid CRL verification.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- security
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 65/100