wolfSSL URI Name Constraint Enforcement Vulnerability in Certificate Chain Verification

A vulnerability exists in wolfSSL's certificate chain verification process, specifically in the URI name constraint handling of constrained intermediate CAs. The issue arises because, while the URI name constraints are parsed, they are not enforced. This flaw allows a compromised or malicious sub-CA to issue leaf certificates with URI Subject Alternative Name entries that disregard the name constraints of the issuing CA. As a result, wolfSSL may incorrectly validate these certificates as legitimate.

Impact

The vulnerability could lead to the acceptance of invalid certificates, potentially allowing for unauthorized actions or impersonation in scenarios where certificate validation is critical.

Remediation

Users are advised to update to the latest version of wolfSSL, where this issue has been addressed.