[openssl.org #3309] Bug: Missing critical flag for extended key usage not detected in time-stamp verification

2014-04-29 Thread Tim Hudson via RT
On Wed Apr 16 14:25:34 2014, s...@pdflib.com wrote: > Am 15.04.14 20:00, schrieb Stephen Henson via RT: > > I've just added a fix (and to two other cases in the same file). Let > me know of any problems. Closed as resolved. SteveH committed changes across all branches. https://github.com/openssl

[openssl.org #3309] Bug: Missing critical flag for extended key usage not detected in time-stamp verification

2014-04-16 Thread Stephan Mühlstrasser via RT
Am 15.04.14 20:00, schrieb Stephen Henson via RT: > I've just added a fix (and to two other cases in the same file). Let me know > of > any problems. The commit now showed up in the public Git repository, so I'm all set now. Best Regards Stephan

[openssl.org #3309] Bug: Missing critical flag for extended key usage not detected in time-stamp verification

2014-04-16 Thread Stephan Mühlstrasser via RT
Am 15.04.14 20:00, schrieb Stephen Henson via RT: > The cause was that the lastpost parameter was set to 0 instead of -1. The > purpose of lastpos is to find multiple extensions of the same time so you can > continue from the last found position or -1 to start from the beginning. > Erroneously sett

[openssl.org #3309] Bug: Missing critical flag for extended key usage not detected in time-stamp verification

2014-04-15 Thread Stephen Henson via RT
On Mon Apr 14 11:52:31 2014, s...@pdflib.com wrote: > > I was not able to find the root cause why X509_get_ext_by_NID() fails to > retrieve the extension here, but the function > check_purpose_timestamp_sign() should also not return 1 if the extended > key usage extension cannot be retrieved, as th

[openssl.org #3309] Bug: Missing critical flag for extended key usage not detected in time-stamp verification

2014-04-14 Thread Stephan Mühlstrasser via RT
Hi, the following problem was reproduced with several OpenSSL 1.0.1 versions and also with a recent build from the OpenSSL_1_0_2-stable branch: RFC 3161 says in "2.3. Identification of the TSA": "The corresponding certificate MUST contain only one instance of the extended key usage field exten