search

square / certstrap

Tools to bootstrap CAs, certificate requests, and signed certificates.
Apache License 2.0
2.31k stars 207 forks source link

Certstrap allows looser permissions but not stricter, which can lead to security issues #136

Closed SBell6hf closed 2 years ago

SBell6hf commented 2 years ago

https://github.com/square/certstrap/blob/fda01dbea1db250eabfe77a8ceef55232cd5a515/depot/depot.go#L116 It must be a minor mistype, however this actually allows looser permissions and prohibits stricter ones, instead of the opposite that we want.

The corrent statement should be if fi.Mode()&^tag.perm != 0 {

isemaya-square commented 2 years ago

Fixed in https://github.com/square/certstrap/pull/141