An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.
Weakness
The product does not validate, or incorrectly validates, a certificate.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Go | Golang | * | 1.24.11 (excluding) |
| Go | Golang | 1.25 (including) | 1.25.5 (excluding) |
| Cert-manager operator for Red Hat OpenShift 1.18 | RedHat | cert-manager/jetstack-cert-manager-rhel9:1768985286 | * |
| Cert-manager operator for Red Hat OpenShift 1.18 | RedHat | cert-manager/jetstack-cert-manager-rhel9:1769093421 | * |
| Cert-manager operator for Red Hat OpenShift 1.18 | RedHat | cert-manager/jetstack-cert-manager-acmesolver-rhel9:1769419550 | * |
| Cert-manager operator for Red Hat OpenShift 1.18 | RedHat | cert-manager/jetstack-cert-manager-rhel9:1769419291 | * |
| Red Hat Hardened Images | RedHat | golang-fips1-25-main-1.25.8-0.1.hum1 | * |
| Red Hat Hardened Images | RedHat | golang1-26-main-1.26.2-1.hum1 | * |
| Red Hat Hardened Images | RedHat | golang1-25-main-1.25.9-1.hum1 | * |
| Golang-1.24 | Ubuntu | plucky | * |