LDAP CertStore searches on the wrong attribute value; empty DN values throw StringIndexOutOfBoundsException #2511

LDAPUtils.parseDN (used by X509LDAPCertStoreSpi and LDAPStoreHelper) finds the attribute by its bare name anywhere in the DN, without requiring the = after it, so the name can match inside another attribute's value.

• With the default o attribute for CA certificate, cross-certificate and CRL lookups, CN=Bob Root CA, O=Example is searched as *b Root CA* instead of *Example*, and the lookup misses.
• A DN with an empty value (O=x, CN=), or a value ending in the attribute name (O=cn, L=y), throws StringIndexOutOfBoundsException out of the CertStore.

For LDAPStoreHelper this is a regression in 1.86: 76b9f66d9e ("refactored out common code from LDAP classes") replaced its own parser, which required the =, with the shared LDAPUtils.parseDN. The LDAP filter escaping (CVE-2023-33201) is not affected.

Impact

Lookups by o/ou miss or match the wrong entries, and with BC's default revocation checking a missed CRL fails the validation. Deployments using soft-fail revocation (PKIXRevocationChecker.Option.SOFT_FAIL) with LDAP-published CRLs have had revocation silently skipped since 1.86 for CAs whose DNs hit this.

Fix

Match the attribute only as name=, and treat an empty value as empty rather than throwing.

AI Disclosure

Parts of this contribution were produced with the assistance of a generative AI tool (Claude Code), under the direction and review of the submitter, in line with the contributing guidelines. The submitter has reviewed and understands the code. To the best of his knowledge, the contribution does not reproduce third-party material.