1705732 - Incorrect tags are used when decoding issuerUniqueID and subjectUniqueID in X509.jsm

Status: NEW

(Core :: Security: PSM, defect, P3)

Description

[Alex Gaynor [:Alex_Gaynor]]

https://searchfox.org/mozilla-central/source/security/manager/ssl/X509.jsm#278-285

These are decoded using the CONSTRUCTED flag, however this is not correct. In RFC 5280 these fields are IMPLICIT, which only has the CONSTRUCTED bit set if the inner-type is CONSTRUCTED. These fields are BIT STRING, which is not CONSTRUCTED, hence this shouldn't be either.

In practice these fields are literally never used, so no one noticed.

See also: https://github.com/pyca/cryptography/pull/5978