Change X509Certificate2 constructor to fix KB5025823 #1343
Change X509Certificate2 constructor to fix KB5025823 #1343k8s-ci-robot merged 1 commit intokubernetes-client:masterfrom weng5e:master
Conversation
|
|
|
Welcome @weng5e! |
k8s-ci-robot
added
size/S
Codecov Report
❗ Your organization is not using the GitHub App Integration. As a result you may experience degraded service beginning May 15th. Please install the Github App Integration for your organization. Read more. @@ Coverage Diff @@
## master #1343 +/- ##
=========================================
Coverage ? 70.60%
=========================================
Files ? 89
Lines ? 2677
Branches ? 0
=========================================
Hits ? 1890
Misses ? 787
Partials ? 0 📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
k8s-ci-robot
added
cncf-cla: yes
k8s-ci-robot
added
the
lgtm
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: tg123, weng5e The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
the
approved
4 participants
Change X509Certificate2 constructor to fix KB5025823. The framework is adding some extra heuristic check for certificate raw data. This issue might only happen for about 1% of certificates (very rough number).
From the KB:
This additional validation performs a series of heuristic checks to determine if the incoming certificate would maliciously exhaust resourcese upon import. Since this is additional validation beyond what the underlying OS would normally perform, it may block certificate blobs which would have successfully imported prior to the June 13, 2023, change.
Example exception
---> System.Security.Cryptography.CryptographicException: PKCS12 (PFX) without a supplied password has exceeded maximum allowed iterations. See https://go.microsoft.com/fwlink/?linkid=2233907 for more information.
---> System.Formats.Asn1.AsnContentException: The encoded length exceeds the maximum supported by this library (Int32.MaxValue).
at System.Formats.Asn1.AsnDecoder.ReadSequence(ReadOnlySpan
1 source, AsnEncodingRules ruleSet, Int32& contentOffset, Int32& contentLength, Int32& bytesConsumed, Nullable1 expectedTag)at System.Security.Cryptography.Asn1.Pkcs12.PfxAsn.CountTotalIterations()
at System.Security.Cryptography.X509Certificates.X509Certificate.GetIterationCount(ReadOnlySpan
1 pkcs12) at System.Security.Cryptography.X509Certificates.X509Certificate.EnforceIterationCountLimit(ReadOnlySpan1 pkcs12, Boolean readingFromFile, Boolean passwordProvided)--- End of inner exception stack trace ---
at System.Security.Cryptography.X509Certificates.X509Certificate.EnforceIterationCountLimit(ReadOnlySpan
1 pkcs12, Boolean readingFromFile, Boolean passwordProvided) at Internal.Cryptography.Pal.PkcsFormatReader.TryReadPkcs12(ReadOnlySpan1 rawData, OpenSslPkcs12Reader pfx, SafePasswordHandle password, Boolean single, Boolean ephemeralSpecified, Boolean readingFromFile, ICertificatePal& readPal, List1& readCerts) at Internal.Cryptography.Pal.PkcsFormatReader.TryReadPkcs12(ReadOnlySpan1 rawData, SafePasswordHandle password, Boolean single, Boolean ephemeralSpecified, Boolean readingFromFile, ICertificatePal& readPal, List1& readCerts, Exception& openSslException) at Internal.Cryptography.Pal.OpenSslX509CertificateReader.FromBlob(ReadOnlySpan1 rawData, SafePasswordHandle password, X509KeyStorageFlags keyStorageFlags)at System.Security.Cryptography.X509Certificates.X509Certificate..ctor(ReadOnlySpan`1 data)