[openssl/openssl] 153a6a: ocsp: Reject update times X509_cmp_time() cannot c...

  Branch: refs/heads/openssl-3.4
  Home:   https://github.com/openssl/openssl
  Commit: 153a6af7cca103e7f1793007914f1337c415175f
      https://github.com/openssl/openssl/commit/153a6af7cca103e7f1793007914f1337c415175f
  Author: Mounir IDRASSI <[email protected]>
  Date:   2026-08-27 (Thu, 27 Aug 2026)

  Changed paths:
    M crypto/ocsp/ocsp_cl.c
    M test/ocspapitest.c

  Log Message:
  -----------
  ocsp: Reject update times X509_cmp_time() cannot compare

OCSP_check_validity() accepts GeneralizedTime forms that
X509_cmp_time() cannot compare. The latter requires the canonical RFC
5280 form and returns 0 for numeric UTC offsets and fractional seconds.
That error was treated as an in-range result, allowing OCSP freshness
checks to be bypassed.

Treat errors from the initial thisUpdate and nextUpdate comparisons as
field errors. Run the optional maximum-age check only after the initial
thisUpdate comparison succeeds, avoiding a duplicate field error.

Add regression coverage for offset and fractional forms, including the
maximum-age path.

Fixes #32377

Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Mounir IDRASSI <[email protected]>
Reviewed-by: Bob Beck <[email protected]>
Reviewed-by: Tomas Mraz <[email protected]>
Merge-date: Thu Aug 27 15:15:28 2026
Merged-from: https://github.com/openssl/openssl/pull/32396
(cherry picked from commit 6ceaf1dfe6729853961c6f53e97e635e82da9168)



To unsubscribe from these emails, change your notification settings at https://github.com/openssl/openssl/settings/notifications

-- 
You received this message because you are subscribed to the Google Groups "openssl-commits" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion visit https://groups.google.com/a/openssl.org/d/msgid/openssl-commits/openssl/openssl/push/refs/heads/openssl-3.4/058f3d-153a6a%40github.com.