php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #65698 certificates validity parsing does not work past 2050
Submitted: 2013-09-18 14:51 UTC Modified: 2014-06-08 21:21 UTC
Votes:3
Avg. Score:4.7 ± 0.5
Reproduced:2 of 2 (100.0%)
Same Version:1 (50.0%)
Same OS:0 (0.0%)
From: tranzig at gmail dot com Assigned: stas (profile)
Status: Closed Package: OpenSSL related
PHP Version: master-Git-2013-09-18 (Git) OS:
Private report: No CVE-ID: None
View Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
If you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: tranzig at gmail dot com
New email:
PHP Version: OS:

 

 [2013-09-18 14:51 UTC] tranzig at gmail dot com 
Description:
------------
In asn1_time_to_time_t [ext/openssl/openssl.c], the Y2K bug makes a cameo 
appearance:
[...]
*thestr = '\0';
thestr -= 2;
thetime.tm_year = atoi(thestr);

if (thetime.tm_year < 68) {
  thetime.tm_year += 100;
}

This piece of code is the part of a backwards UTCTime parser. It moves 2 
positions to the left, and converts those two characters to an int.

However, certs with a validity past 2050 contain GeneralizedTime formatted 
timestamps allowing 4 characters in the year field instead of the UTCTime this 
function parses (badly). [rfc5280, 4.1.2.5]

Test script:
---------------
An example script that demonstrates the problem with a cert expiring 2101:
http://pastebin.com/Yij0q1qn

Expected result:
----------------
Actual time string of validity:  21010828070405Z
parsed with strtotime:           4154655845 [2101-08-28]
parsed with asn1_time_to_time_t: 4154655845  [2101-08-28]

Actual result:
--------------
Actual time string of validity:  21010828070405Z
parsed with strtotime:           4154655845 [2101-08-28]
parsed with asn1_time_to_time_t: 998982245  [2001-08-28]

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2014-03-21 15:34 UTC] oroszisam at gmail dot com 
With the fix for CVE-2013-6420, this bug became even more visible.

Now, instead of silently returning an incorrect timestamp, a PHP 
warning is thrown for all certificates where the notBefore or 
notAfter field is in the GeneralizedTime format, stating that it is an 
"illegal ASN1 data type for timestamp", which is an obviously incorrect
statement.
 [2014-03-21 15:41 UTC] oroszisam at gmail dot com 
Related To: Bug #66636
 [2014-06-08 21:21 UTC] stas@php.net
-Status: Open +Status: Closed -Assigned To: +Assigned To: stas
 [2014-06-08 21:21 UTC] stas@php.net 
The fix for this bug has been committed.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.

 For Windows:

http://windows.php.net/snapshots/
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Wed Oct 29 13:00:01 2025 UTC