RFR: 8296343: CPVE thrown on missing content-length in OCSP response
Mark Powers
mpowers at openjdk.org
Tue Jan 10 16:02:56 UTC 2023
On Tue, 10 Jan 2023 06:02:29 GMT, Jamil Nimeh <jnimeh at openjdk.org> wrote:
> This fixes an issue where HTTP responses that do not have an explicit Content-Length are causing an EOFException which unravels into a CertPathValidatorException during validations that involve OCSP checks.
>
> - JBS: https://bugs.openjdk.org/browse/JDK-8296343
test/jdk/sun/security/provider/certpath/OCSP/OCSPNoContentLength.java line 58:
> 56:
> 57: // Turn on debugging
> 58: static final boolean debug = true;
Do you really mean to set `debug` to `true`?
-------------
PR: https://git.openjdk.org/jdk/pull/11917
More information about the security-dev
mailing list