1857576 - Chrome and Firefox parse certificate CRL and Cert Policies in digital certificates differently

Status: UNCONFIRMED

(Firefox :: Security, defect)

Description

[2295456556]

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36 Edg/113.0.1774.35

Steps to reproduce:

1.Use Python to create a local server (e.g. using Flask) and specify a mutated certificate and private key. Access the Flask provided url in Chrome.
2.In Firefox, visit the url about:certificate?cert=(processed pem data) containing the certificate information.
3.In your own developers'way, let the browser parse mutated certificate files, then observe the results.

Actual results:

Description: We tested with a mutated digital certificate as a test case. We have discovered differences in the parsing results of the certificate CRL and Cert Policies for mutated digital certificates between Google Chrome and Mozilla Firefox browsers.
Mutation Strategy: Exchange a distribution point URL node in CRL and a domain name node in Cert Policies through TLV structure.
OS: Windows 10 22H2 19045.2604
My expectations: Confirm whether this is a security bug or a UI bug
Additional Comments:The public key of the certificate is generated by myself using my own private key and has been replaced.

Expected results:

I don't know which of these two different certificate CRL and Cert Policies is correct. So I need you to confirm whether this difference is a bug or not

Comment 1

[2295456556]

Attachment: 9ba9df26-6139-11ee-a379-202b206f6d12systemjs.1688.com_1.der

Comment 2

[2295456556]

Attachment: 9ba9df26-6139-11ee-a379-202b206f6d12systemjs.1688.com_1.pem

Comment 3

[2295456556]

Attachment: LIBK8Y9{Y{O%W{~3`LUR5%E.png

Comment 4

[2295456556]

Attachment: UQNUG0WG83ANOO_OP%05HX6.png

Comment 5

[2295456556]

Attachment: rsa_praviatekey_2048bit.pem

Comment 6

[BugBot [:suhaib / :marco/ :calixte]]

The Bugbug bot thinks this bug should belong to the 'Core::Security: PSM' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.

Comment 7

[Dana Keeler (she/her) [:keeler]]

Firefox does not make trust decisions based on how the certificate viewer displays certificates. At most, this is a display issue.

Comment 8

[2295456556]

So please ask if this is a bug

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

The severity field is not set for this bug.
:serg, could you have a look please?

For more information, please visit BugBot documentation.

Comment 10

[2295456556]

About the CRL field, I think firefox mistakenly recognized the DNS name as a URL