[7u40] Request for Phase 2 approval for 8014805: NPE is thrown during certpath validation if certificate does not have AuthorityKeyIdentifier extension (original) (raw)
Vincent Ryan vincent.x.ryan at oracle.com
Mon Jun 24 04:41:01 PDT 2013
- Previous message: [7u40] Request for Phase 2 approval for 7165807: Non optimized initialization of NSS crypto library leads to scalability issue
- Next message: [7u40] Request for Phase 2 approval for 8014805: NPE is thrown during certpath validation if certificate does not have AuthorityKeyIdentifier extension
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
Hello all,
Please approve the following fix for 7u40:
Bug: http://bugs.sun.com/view_bug.do?bug_id=8014805 Webrev: http://cr.openjdk.java.net/~vinnie/8014805/webrev.00/ Code review: http://mail.openjdk.java.net/pipermail/security-dev/2013-June/007886.html
This simple fix corrects the way an Authority Key Identifier (AKID) X.509 certificate extension is handled during OCSP certificate validation. Two forms of AKID are permitted: hash-based and name/serial number based. The fix for 7168191 (7u6) added a check to match AKIDs when distinguishing certificates with the same subject name. This fix corrects that check to handle the rare case when a certificate contains a non-hash-based AKID.
This problem does not occur in JDK 8 (because a different code path is used).
Thanks.
- Previous message: [7u40] Request for Phase 2 approval for 7165807: Non optimized initialization of NSS crypto library leads to scalability issue
- Next message: [7u40] Request for Phase 2 approval for 8014805: NPE is thrown during certpath validation if certificate does not have AuthorityKeyIdentifier extension
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]