Your message dated Tue, 14 Jul 2026 15:12:55 +0000
with message-id <[email protected]>
and subject line Bug#1142034: fixed in libcrypt-openssl-x509-perl 2.1.3-1
has caused the Debian Bug report #1142034,
regarding libcrypt-openssl-x509-perl: CVE-2026-58101 CVE-2026-58102
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1142034: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1142034
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libcrypt-openssl-x509-perl
Version: 2.1.2-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerabilities were published for libcrypt-openssl-x509-perl.
CVE-2026-58101[0]:
| Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of
| service via NULL pointer dereference. X509V3_EXT_d2i(ext) returns
| NULL when an extension's DER value fails to parse. basicC,
| ia5string, and auth_att dereference its result without a NULL check.
| keyid_data also dereferences akid->keyid, which is NULL for an empty
| AKI SEQUENCE (DER 30 00) even when the parse succeeds. A caller
| invoking an affected helper on an extension from an untrusted
| certificate triggers a SIGSEGV that crashes the Perl process.
CVE-2026-58102[1]:
| Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap
| out-of-bounds read via a long certificate extension OID in hv_exts.
| When building the extension hash (via extensions(),
| extensions_by_long_name(), extensions_by_oid(), or
| has_extension_oid()), the code passes OBJ_obj2txt()'s return value
| as the hash-key length; because that value is the OID's full text
| length rather than the bytes written to the fixed-size buffer (129
| bytes), an OID whose text is longer than the 129-byte buffer causes
| a read past the allocation, exposing adjacent heap memory as the
| returned hash key. extensions_by_name() uses the static shortname
| path and is not affected.
If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-58101
https://www.cve.org/CVERecord?id=CVE-2026-58101
[1] https://security-tracker.debian.org/tracker/CVE-2026-58102
https://www.cve.org/CVERecord?id=CVE-2026-58102
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: libcrypt-openssl-x509-perl
Source-Version: 2.1.3-1
Done: gregor herrmann <[email protected]>
We believe that the bug you reported is fixed in the latest version of
libcrypt-openssl-x509-perl, which is due to be installed in the Debian FTP
archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
gregor herrmann <[email protected]> (supplier of updated
libcrypt-openssl-x509-perl package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 14 Jul 2026 16:48:37 +0200
Source: libcrypt-openssl-x509-perl
Architecture: source
Version: 2.1.3-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Perl Group <[email protected]>
Changed-By: gregor herrmann <[email protected]>
Closes: 1142034
Changes:
libcrypt-openssl-x509-perl (2.1.3-1) unstable; urgency=medium
.
* Import upstream version 2.1.3.
- Fixed CVE-2026-58102: heap out-of-bounds read in `hv_exts()`.
- Fixed CVE-2026-58101: NULL-pointer dereference in several
`Crypt::OpenSSL::X509::Extension` helpers.
Closes: #1142034
Checksums-Sha1:
8ccfcdc600af8f215ae8e58c194bbd23f6088d61 2792
libcrypt-openssl-x509-perl_2.1.3-1.dsc
814812b88e61d95d50976697f75c36b4087f014d 178318
libcrypt-openssl-x509-perl_2.1.3.orig.tar.gz
1cc6120b92be04d4aaee1811a973ecafb630ba8c 5432
libcrypt-openssl-x509-perl_2.1.3-1.debian.tar.xz
Checksums-Sha256:
a359fc448590ed7811ab341e30c16438f2c1d7b5e0dcc02def57a8fc276f28e0 2792
libcrypt-openssl-x509-perl_2.1.3-1.dsc
0ad965175746ae846b0510b038aa1f96d2ddb8c860fe97cea6fbdc7a055f9f9e 178318
libcrypt-openssl-x509-perl_2.1.3.orig.tar.gz
43537761fe5b17b5f85ef77e0f3dc034d485d2aacbe0ded50a44273e62857b3e 5432
libcrypt-openssl-x509-perl_2.1.3-1.debian.tar.xz
Files:
0e356e290c6f0f45e663092329c25eb8 2792 perl optional
libcrypt-openssl-x509-perl_2.1.3-1.dsc
39da0465924533faf4aa5182587e7f12 178318 perl optional
libcrypt-openssl-x509-perl_2.1.3.orig.tar.gz
d995ca6a8aecc13a414bdf5b72146424 5432 perl optional
libcrypt-openssl-x509-perl_2.1.3-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQKTBAEBCgB9FiEE0eExbpOnYKgQTYX6uzpoAYZJqgYFAmpWTPVfFIAAAAAALgAo
aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEQx
RTEzMTZFOTNBNzYwQTgxMDREODVGQUJCM0E2ODAxODY0OUFBMDYACgkQuzpoAYZJ
qgYKuQ/+ITTHPjtM6FHMvqYUrMMx9daQq1mitCe1hiA9wyWRWnNdGSeMDTAFKB8r
80amnrSTHp0JIQumHmRI5KpHPGjFXatrtmKjLWafiVc0gixTV27fpK98/WcmDxQX
VLSiXAqDzuixp3gomBwA4FFD23jiM9YDuSvd5/UoKf19W6hWfHzNl9gFRS6Cm4Wr
5KYJo8iC2omxb6Hoe7RL88tpzVf75fqnrIntMcdahckqqBxuI+PSRK3qEmG10dT4
8R6ZKiU1y8gIJJh+U76A5M9dWj0aWbJ/Xpclvplgk6YjnBHn1BEdxgwSGM2wO2Fj
YBsbtm78/yKW251ECF6R1St8Ri8EQJzdiwpuU0GyKNreq6XAPo5NdBglNGU17jD3
U1Q/q+k4mAAOI+hbAMlezB/bgxF9bDm2uK4D2QU/pev6oXcYBpsnfM4mRZacO6EO
gTgy6o/Bd3PgqY+5kseaXK+euDe6K0zdl4FvnNAagf2v3A44gmcPySu3X79qYzvf
ixpmtmQhs7v4LWcP0oX9fthyx+brdedd68Yz75EDgSp7FzzsvmGMWX0pq4ESwVlF
WFGbfhteXJJyJ6T5FkgNM589Tm6X7CDhD+wHPSNPuiDP2yAUIWeSksXzOpshaop1
CD0BNywULPci/oXRMrRyTfluRYi0LEiMQFlbAhX0NIMaOQpglvg=
=jVn9
-----END PGP SIGNATURE-----
pgpky2JRBMZhN.pgp
Description: PGP signature
--- End Message ---
