[openssl/openssl] c26731: Reject delta CRLs as complete CRL candidates

  Branch: refs/heads/openssl-4.0
  Home:   https://github.com/openssl/openssl
  Commit: c26731f5d0a5e3b7d262282d4231d903713c06db
      https://github.com/openssl/openssl/commit/c26731f5d0a5e3b7d262282d4231d903713c06db
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-06-17 (Wed, 17 Jun 2026)

  Changed paths:
    M crypto/x509/x509_vfy.c
    A test/certs/delta-crl-as-complete-ca.pem
    A test/certs/delta-crl-as-complete-delta-reasons.pem
    A test/certs/delta-crl-as-complete-delta.pem
    A test/certs/delta-crl-as-complete-leaf.pem
    M test/recipes/25-test_verify.t

  Log Message:
  -----------
  Reject delta CRLs as complete CRL candidates

get_crl_score() is used when selecting a complete/base CRL. Its delta CRL
rejection was chained after the extended CRL and IDP reason handling,
so it could be skipped when extended CRL support was disabled, or when
an IDP onlySomeReasons branch was taken.

As a result, a CRL with a Delta CRL Indicator could be scored as
a complete/base CRL candidate. Since a delta CRL contains only changes
relative to a base CRL, this could cause a previously revoked certificate
to be accepted as valid when only the delta CRL is presented to the verifier.

Reject CRLs with base_crl_number unconditionally in get_crl_score() before
IDP reason filtering. Delta CRLs are still considered by get_delta_sk()
after a complete CRL is selected and check_delta_base() confirms compatibility.

Add verify recipe coverage for a delta CRL being rejected as a complete CRL,
and for a delta CRL with IssuingDistributionPoint.onlySomeReasons being
rejected under -extended_crl.

Reported-by: jujerpig (GitHub issue #31040)

Fixes #31040

Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
MergeDate: Wed Jun 17 08:53:02 2026
(Merged from https://github.com/openssl/openssl/pull/31044)

(cherry picked from commit 5a3723e2543684f86ad54ee8ae65db7556cbccd3)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-4.0/c39b48-c26731%40github.com.