rustls-webpki vulnerabilities

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints.

rustls-webpki versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accept permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com is treated as satisfied by a certificate for *.example.com, which could assert reject.example.com outside the permitted subtree.

rustls-webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, accepting rather than enforcing them. These constraints apply to otherwise properly issued certificates, so the flaw is reachable after successful signature verification and requires a misissued certificate.

rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/der.rs. The input guard fails to reject a named-bit BIT STRING with content exactly [0x00], causing an underflow and panic. Reachable via BorrowedCertRevocationList::from_der() when a CRL contains an issuingDistributionPoint extension with such an onlySomeReasons value. Requires an application that opts in to CRL revocation checking and parses attacker-influenced CRL bytes; default rustls configuration is unaffected. Fixed in 0.103.13 and 0.104.0-alpha.7.