SecTrust name-constraint defense in depth improvements
details
- Finding IDs
- F-SECTRUST-DN-001 / F-SECTRUST-URI-001
- Status
- fix mapping unconfirmed
- Recorded credit
- Apple publicly acknowledges Oleh Konko of 1seal (1seal.org) in Additional recognition > Security.
- Note
- Apple confirmed to the researcher that the directoryName and URI name-constraint reports were tracked under one internal issue and classified as a defense in depth security improvement, rather than a direct security vulnerability. Apple stated that exploitation requires control of a compromised subordinate Certificate Authority and that no CVE would be issued. The public macOS Tahoe 26.6 advisory confirms the acknowledgement; it does not identify the individual mechanisms, exact patch or report-specific fixed release. The association of these two finding IDs and the classification come from vendor correspondence supplied by the researcher. One shared recognized improvement, not two independent vulnerabilities; patch authorship is not claimed.
F-SECTRUST-DN-001: Needs source detail. Apple publicly acknowledges the researcher under Security, without identifying a report-specific defect mechanism. Technical mapping and assessment are attributed separately to researcher-supplied correspondence. Reviewed 14 Oct 2026. Mechanism assessed by 1seal.
Mechanism source for F-SECTRUST-DN-001
F-SECTRUST-URI-001: Needs source detail. Apple publicly acknowledges the researcher under Security, without identifying a report-specific defect mechanism. Technical mapping and assessment are attributed separately to researcher-supplied correspondence. Reviewed 14 Oct 2026. Mechanism assessed by 1seal.
Mechanism source for F-SECTRUST-URI-001
Security area (1seal assessment): Unclassified. The public Apple Security acknowledgement provides no report-specific technical detail or patch. The name-constraint mapping and vendor assessment are separately attributed to correspondence supplied by the researcher. Reviewed 14 Oct 2026.