[jdk17u-dev] RFR: 8296343: CPVE thrown on missing content-length in OCSP response

[Goetz Lindenmaier]

On Thu, 18 May 2023 15:59:18 GMT, Alexey Pavlyutkin <duke at openjdk.org> wrote:

> Hi!
> 
> Here is backport of [JDK-8296343](https://bugs.openjdk.org/browse/JDK-8296343). The patch fixes CertPathValidatorException taking place if OCSP response does not contain `ContentLength` field.
> 
> Original patch is applied cleanly.
> 
> Verification/regression (amd64/20.04 LTS): `jdk_security` including newly added `test/jdk/sun/security/provider/certpath/OCSP/OCSPNoContentLength.java`

Hi  @apavlyutkin  
since this push we see OCSPNoContentLength.java failing in out nightly tests.
There is a related issue handling this: [JDK-8300939](https://bugs.openjdk.org/browse/JDK-8300939)

sun/security/provider/certpath/OCSP/OCSPNoContentLength.java fails due to network errors

Please backport this, too! 
And next time  please check related issues in the JBS Bug before labeling fix-request!!!!

-------------

PR Comment: https://git.openjdk.org/jdk17u-dev/pull/1361#issuecomment-1560493482