Please review the patch and feedback.

A workaround exists with the new option --ignore-crl-extensions.

Now also done for libksba.

Fixed in libksba 1.6.6.

@Jakuje, you are right. This is a plain error and we should do a new release to avoid false errors.

Thank you, applied.

And yes in gpgsm.conf both the extensions are also marked with ignore-cert-extension.

While remembering this I added to our standard.conf (and for testing first to my local conf):

We had one request to support this back in 2017 but it was closed because the respective CA stopped using this extension. See T2039.

rGb1ecc8353ae3 is just what I meant, so that we can recommend such an option in the future as a workaround until a new update becomes available which supports such an extension.

Nah, the description for that extension is pretty strict and I won't feel comfortable to just ignore it. BTW there is also T6398 (nameConstraints) which needs support. But for debugging a ignore extension makes sense.

For support reasons I would say that it might make sense to also ignore the extensions from "ignore-cert-extension" when checking CRLs?

(my example cert is 0x09BB0EEE)

This bug is CVE-2022-47629