Reject setting invalid CSR versions

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Tim Hudson <tjh@openssl.org>
Reviewed-by: Neil Horman <nhorman@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/23965)

diff --git a/crypto/x509/x509rset.c b/crypto/x509/x509rset.c
index 344993d4c78c440e44bc01ee0023b41a71fbf640..0806b0c9000924ef8a49ef81dfb34ca0da1c7460 100644 (file)
--- a/crypto/x509/x509rset.c
+++ b/crypto/x509/x509rset.c
@@ -17,8 +17,10 @@
 
 int X509_REQ_set_version(X509_REQ *x, long version)
 {
-    if (x == NULL)
+    if (x == NULL || version != X509_REQ_VERSION_1) {
+        ERR_raise(ERR_LIB_X509, ERR_R_PASSED_INVALID_ARGUMENT);
         return 0;
+    }
     x->req_info.enc.modified = 1;
     return ASN1_INTEGER_set(x->req_info.version, version);
 }