You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Due to an insufficient error check with sscanf() in asn1time_to_time(), OpenSSL::ASN1.decode ignores any fractional seconds or time zone information in DER/BER.
$ ruby -ropenssl -e'p OpenSSL::ASN1.decode("\x18\x13" + "20161208193439.123Z").value'
2016-12-08 19:34:39 UTC # <- The fractional seconds is lost
$ ruby -ropenssl -e'p OpenSSL::ASN1.decode("\x18\x13" + "20161208193439+0900").value'
2016-12-08 19:34:39 UTC # <- Timezone is lost
The text was updated successfully, but these errors were encountered:
rhenium
changed the title
OpenSSL::ASN1.decode doesnUTCTime or GeneralizedTime with fractionsl
OpenSSL::ASN1.decode doesn't correctly parse UTCTime or GeneralizedTime with fractional seconds or a timezone
Mar 11, 2024
#724 reminded me of this issue.
Due to an insufficient error check with
sscanf()
inasn1time_to_time()
,OpenSSL::ASN1.decode
ignores any fractional seconds or time zone information in DER/BER.openssl/ext/openssl/ossl_asn1.c
Lines 19 to 70 in 1e8e246
openssl/test/openssl/test_asn1.rb
Lines 435 to 452 in 1e8e246
The text was updated successfully, but these errors were encountered: