From 4dae392b32a2c56441fd7ca50ad32a0874455995 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Fri, 19 Jun 2026 11:57:48 +0200 Subject: [PATCH] x509: Avoid NULL-pointer dereference if issuerName is missing in attribute certificate If neither authoritiyKeyIdentifier nor issuerName are encoded in an attribute certificate, the validation in `acert_validator.c:verify()` will cause a NULL-pointer dereference via `issued_by()` (the lookup with NULL identity will enumerate all trusted certificates). Fixes: 26930a8c3e42 ("certificate factory can load certs from file") Fixes: CVE-2026-78130 --- src/libstrongswan/plugins/x509/x509_ac.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/libstrongswan/plugins/x509/x509_ac.c b/src/libstrongswan/plugins/x509/x509_ac.c index 4fa9f6d0a3e0..4436bc4debef 100644 --- a/src/libstrongswan/plugins/x509/x509_ac.c +++ b/src/libstrongswan/plugins/x509/x509_ac.c @@ -897,7 +897,11 @@ METHOD(certificate_t, has_issuer, id_match_t, { return ID_MATCH_PERFECT; } - return this->issuerName->matches(this->issuerName, issuer); + if (this->issuerName) + { + return this->issuerName->matches(this->issuerName, issuer); + } + return ID_MATCH_NONE; } METHOD(certificate_t, issued_by, bool, @@ -934,7 +938,8 @@ METHOD(certificate_t, issued_by, bool, } else { - if (!this->issuerName->equals(this->issuerName, + if (!this->issuerName || + !this->issuerName->equals(this->issuerName, issuer->get_subject(issuer))) { return FALSE; -- 2.43.0