wbond / wbond/certvalidator

Certificate validation issue

Open
#31 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
115
Forks
34
PR merge metrics
No merged PRs in 30d

Description

Hi, I'm using certvalidator 0.11.1 to validate a certificate with a chain.

The validation fails in method verify_crl, with the following traceback:

File "/usr/local/lib/python3.8/site-packages/certvalidator/init.py", line 193, in validate_usage
self._validate_path()
File "/usr/local/lib/python3.8/site-packages/certvalidator/init.py", line 121, in _validate_path
validate_path(self._context, candidate_path)
File "/usr/local/lib/python3.8/site-packages/certvalidator/validate.py", line 50, in validate_path
return _validate_path(validation_context, path)
File "/usr/local/lib/python3.8/site-packages/certvalidator/validate.py", line 402, in _validate_path
verify_crl(
File "/usr/local/lib/python3.8/site-packages/certvalidator/validate.py", line 1243, in verify_crl
if isinstance(distribution_point['crl_issuer'], x509.GeneralNames):
TypeError: string indices must be integers

Apparently one is trying to index a string with a string ...

Attached goes a series of test certificates with a target certificate (sig.der) and its certification chain. I got the error when checking the validity of sig.der.
sig.zip

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in certvalidator/validate.py at verify_crl, especially the reported line 1243, and reproduce the failure with sig.der and the attached certificate chain in sig.zip. Trace how the distribution point is represented before that access. Done means validating sig.der no longer raises the reported TypeError.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
cryptography, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.