python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

SummaryIf an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of .example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. PoC!/usr/bin/env python3"""Standalone PoC: pyca's...