Since the update to BC v1.85 we have faced with inability to process CMS signatures with malformed UTCTime fields, resulting to an exception:
Caused by: java.lang.IllegalStateException: invalid UTCTime format
at org.bouncycastle.util.Exceptions.illegalStateException(Unknown Source)
at org.bouncycastle.asn1.DLSequenceParser.toASN1Primitive(Unknown Source)
at org.bouncycastle.cms.CMSSignedDataParser.getSignerInfos(Unknown Source)
... 56 more
Caused by: org.bouncycastle.asn1.ASN1Exception: invalid UTCTime format
at org.bouncycastle.asn1.ASN1InputStream.createPrimitiveDERObject(Unknown Source)
at org.bouncycastle.asn1.ASN1StreamParser.parseImplicitPrimitive(Unknown Source)
at org.bouncycastle.asn1.ASN1StreamParser.implParseObject(Unknown Source)
at org.bouncycastle.asn1.ASN1StreamParser.readVector(Unknown Source)
at org.bouncycastle.asn1.DLSetParser.getLoadedObject(Unknown Source)
at org.bouncycastle.asn1.ASN1StreamParser.readVector(Unknown Source)
at org.bouncycastle.asn1.DLSequenceParser.getLoadedObject(Unknown Source)
at org.bouncycastle.asn1.ASN1StreamParser.readVector(Unknown Source)
at org.bouncycastle.asn1.ASN1StreamParser.loadTaggedDL(Unknown Source)
at org.bouncycastle.asn1.DLTaggedObjectParser.getLoadedObject(Unknown Source)
at org.bouncycastle.asn1.ASN1StreamParser.readVector(Unknown Source)
at org.bouncycastle.asn1.DLSequenceParser.getLoadedObject(Unknown Source)
... 63 more
Caused by: java.lang.IllegalArgumentException: invalid UTCTime format
at org.bouncycastle.asn1.ASN1UTCTime.createPrimitive(Unknown Source)
... 75 more
We think it is a bit too harsh to fail a complete CMS loading because of a single malformed field. We would prefer to have the malformed field to be skipped instead and an error or warning to be logged, instead of a complete failure. With the current behavior we are not able to produce a validation report for the concerned signatures.
A test file is attached to the ticket.
BC185_UTCTime.zip
Since the update to BC v1.85 we have faced with inability to process CMS signatures with malformed UTCTime fields, resulting to an exception:
We think it is a bit too harsh to fail a complete CMS loading because of a single malformed field. We would prefer to have the malformed field to be skipped instead and an error or warning to be logged, instead of a complete failure. With the current behavior we are not able to produce a validation report for the concerned signatures.
A test file is attached to the ticket.
BC185_UTCTime.zip