Merge pull request #6772 from jetstack-bot/cherry-pick-6770-to-releas…

…e-1.13

[release-1.13] Fix a memory bug in ldap's ParseDN function by disabling part of the functionality

pkg/util/pki/parse_test.go

@@ -454,3 +454,12 @@ func TestMustKeepOrderInRawDerBytes(t *testing.T) {
 	assert.Equal(t, expectedRdnSeq, rdnSeq)
 	assert.Equal(t, subject, rdnSeq.String())
 }
+
+func TestShouldFailForHexDER(t *testing.T) {
+	_, err := ParseSubjectStringToRawDERBytes("DF=#6666666666665006838820013100000746939546349182108463491821809FBFFFFFFFFF")
+	if err == nil {
+		t.Fatal("expected error, but got none")
+	}
+
+	assert.Contains(t, err.Error(), "unsupported distinguished name (DN) \"DF=#6666666666665006838820013100000746939546349182108463491821809FBFFFFFFFFF\": notation does not support x509.subject identities containing \"=#\"")
+}

pkg/util/pki/subject.go

@@ -20,6 +20,8 @@ import (
 	"crypto/x509/pkix"
 	"encoding/asn1"
 	"errors"
+	"fmt"
+	"strings"
 
 	"github.com/go-ldap/ldap/v3"
 )
@@ -65,6 +67,10 @@ var attributeTypeNames = map[string][]int{
 }
 
 func UnmarshalSubjectStringToRDNSequence(subject string) (pkix.RDNSequence, error) {
+	if strings.Contains(subject, "=#") {
+		return nil, fmt.Errorf("unsupported distinguished name (DN) %q: notation does not support x509.subject identities containing \"=#\"", subject)
+	}
+
 	dns, err := ldap.ParseDN(subject)
 	if err != nil {
 		return nil, err