CVSROOT: /cvs
Module name: src
Changes by: [email protected] 2026/10/19 22:39:15
Modified files:
lib/libcrypto/ocsp: ocsp_ht.c ocsp_lib.c ocsp_local.h
Log message:
ocsp: validate URI characters in OCSP
In OCSP_sendreq_new() and OCSP_parse_url() reject URIs containing control
characters. Since these APIs are typically used to create a POST request
to an untrusted cert's Authority Information Access accessLocation URI,
lack of sanitization meant that there is a path for header injection via
CRLF and similar tricks.
Reported by Aziz ELBELAYCHY (also for ocspcheck.c r1.40)
ok beck kenjiro
