Apple SecTrust fallback ignores CURLOPT_CRLFILE, letting a revoked cert pass
该报告还没有中文解读。
原文摘录
摘自原文（11966 字符中的一小部分）
When libcurl is built with `USE_APPLE_SECTRUST` and the native (Apple) trust store is in use, a certificate that OpenSSL/GnuTLS rejects because it is on the operator's `CURLOPT_CRLFILE` list is re-checked by Apple's `SecTrust` API instead, and `SecTrust` is never told about that CRL file at all.
原文中的代码
// lib/vtls/openssl.c:3108-3118
if(ssl_crlfile) {
/* tell OpenSSL where to find CRL file that is used to check certificate
* revocation */
lookup = X509_STORE_add_lookup(store, X509_LOOKUP_file());
if(!lookup ||
(!X509_load_crl_file(lookup, ssl_crlfile, X509_FILETYPE_PEM))) { …默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @giant_anteater · 版权归作者与 curl 所有