GHSA-5X38-2VFF-X55P Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

Summary node-forge parses certificate extensions with the deprecated OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and forge.pki.verifyCertificateChain used the first extension with that name. A certificate with a forged deprecated-OID extension cA TRUE before its genuine basicConstraints...

Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13

Summary node-forge parses certificate extensions with the deprecated OIDs 2.5.29.10 and 2.5.29.13 as basicConstraints, and forge.pki.verifyCertificateChain used the first extension with that name. A certificate with a forged deprecated-OID extension cA TRUE before its genuine basicConstraints...