lsh123/xmlsec xmlsec-1.2.43-rc1

XMLSec 1.2.43 (legacy)

on GitHub

XMLSec 1.2.x is in MAINTENANCE MODE ; PLEASE UPGRADE TO THE LATEST XMLSec 1.3.x

Please test the release candidate (signature) and let me know if you see any issues:

• (xmlsec-core not backward compatible) Restricted the default enabled reference and transform URIs to empty and same document URIs only. Use --enabled-reference-uris, --enabled-retrieval-method-uris, etc. parameters for XMLSec command line tool if local or remote URIs usage is required (or set corresponding flag in the xmlSecDSigCtx and xmlSecEncCtx structs in your application code).
• (xmlsec-core not backward compatible) Removed support for negative values in BN string conversion/parsing helpers; values are now treated as unsigned magnitudes.
• (xmlsec-build not backward compatible) Raised minimum supported OpenSSL version to 1.1.0 and fail-fast on unsupported legacy OpenSSL/LibreSSL versions.
• (xmlsec-build not backward compatible) Added '-std=c23' compiler flag for building the library on compilers that support it or '-std=c99' otherwise (this flag was only enabled with --enable-pedantic builds in the past).
• (xmlsec-core not backward compatible) Added attribute values escaping in the Relationship transform.
• (xmlsec-core) Hardened XML parser defaults for XXE mitigation across libxml2 versions.
• (xmlsec-core) Added stronger overflow and conversion safety checks.
• (xmlsec-core) Fixed multiple memory/resource issues on error paths.
• (xmlsec-core) Enforced the max nesting depth when processing EncryptedKey elements (default is 1); documents with deeper nested EncryptedKey structures will now fail to decrypt. Use the --max-encrypted-key-level <level> option in the xmlsec command line tool (or set xmlSecKeyInfoCtx->maxEncryptedKeyLevel in your application code) to adjust the limit.
• (xmlsec-openssl) Improved X.509/CRL verification flow with verification-time-aware revocation checks and stricter CRL validity handling.
• (xmlsec-gnutls) Prevented certificate-chain self-loop cases and improved SKI comparison behavior when SKI extension is absent.
• (xmlsec-nss) Fixed certificate lookup memory handling in issuer/serial resolution paths.
• (xmlsec-mscng) Added stronger CRL signature/time validation logic and recursion guards in revocation verification.
• (xmlsec-mscrypto) Changed CRL lookup behavior to fail closed on API errors during revocation checks.
• (xmlsec-cli) Hardened the --verification-time/--verification-gmt-time argument parsing (strict field validation, support for the "YYYY-MM-DD+HH:MM:SS" format) and fixed the --xxe option to actually re-enable external entity loading on libxml2 2.13+.
• Several other small fixes (more details).

Thanks for bug reports!
Aleksey