From 3ee2cb707002f755e4bda3f75285caa0cb36c214 Mon Sep 17 00:00:00 2001 From: Alexander Sosedkin Date: Wed, 15 Apr 2026 15:35:59 +0200 Subject: [PATCH] x509/email-verify: call fallback DN fallback A comment was inaccurately referring to DN email field fallback as CN fallback. Rename a few things as well to match x509/hostname-verify more closely. Signed-off-by: Alexander Sosedkin CVE: CVE-2026-42013 Upstream-Status: Backport [https://gitlab.com/gnutls/gnutls/-/commit/3ee2cb707002f755e4bda3f75285caa0cb36c214] Signed-off-by: Jakub Szczudlo --- lib/x509/email-verify.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/lib/x509/email-verify.c b/lib/x509/email-verify.c index dbef0bb86e..3c22ffed37 100644 --- a/lib/x509/email-verify.c +++ b/lib/x509/email-verify.c @@ -42,7 +42,7 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email, { char rfc822name[MAX_CN]; size_t rfc822namesize; - int found_rfc822name = 0; + bool dn_fallback_allowed = true; int ret = 0; int i = 0; char *a_email; @@ -76,7 +76,7 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email, cert, i, rfc822name, &rfc822namesize, NULL); if (ret == GNUTLS_SAN_RFC822NAME) { - found_rfc822name = 1; + dn_fallback_allowed = false; if (memchr(rfc822name, '\0', rfc822namesize)) { _gnutls_debug_log( @@ -102,12 +102,10 @@ unsigned gnutls_x509_crt_check_email(gnutls_x509_crt_t cert, const char *email, } } - if (!found_rfc822name) { - /* did not get the necessary extension, use CN instead - */ + if (dn_fallback_allowed) { + /* did not get the necessary extension, use DN email instead */ - /* enforce the RFC6125 (ยง1.8) requirement that only - * a single CN must be present */ + /* only a single one must be present */ rfc822namesize = sizeof(rfc822name); ret = gnutls_x509_crt_get_dn_by_oid(cert, GNUTLS_OID_PKCS9_EMAIL, 1,