========================================================================
CVE-2026-17510 CPAN Security Group
========================================================================
CVE ID: CVE-2026-17510
Distribution: Crypt-OpenSSL-PKCS12
Versions: before 1.98
MetaCPAN: https://metacpan.org/dist/Crypt-OpenSSL-PKCS12
VCS Repo: https://github.com/dsully/perl-crypt-openssl-pkcs12
Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL
pointer dereference in print_attribute via a zero length BMPSTRING
attribute
Description
-----------
Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL
pointer dereference in print_attribute via a zero length BMPSTRING
attribute.
print_attribute() sizes the destination buffer for a BMPSTRING
attribute from its declared byte length with `Renew(*attribute, length,
char)`. A zero length attribute makes that a zero size reallocation,
which Perl implements as a free returning NULL, so the buffer pointer
becomes NULL, the following `strncpy` copies nothing, and the caller
dereferences NULL in the `strlen()` it passes to `newSVpvn()`. A zero
length BMPSTRING is even length, so the ASN.1 decoder accepts it and
the value reaches this code. The UTF8STRING, OCTET STRING and BIT
STRING arms size on `length + 1` or `length * 4 + 1` and are
unaffected.
Any caller that passes an untrusted PKCS#12 file to info_as_hash() can
crash the process. info() prints attribute values directly without
sizing a buffer and is unaffected.
Problem types
-------------
- CWE-476 NULL Pointer Dereference
Workarounds
-----------
For deployments that cannot upgrade to 1.98, ensure that PKCS#12 files
passed to info_as_hash() come from trusted sources.
Solutions
---------
Upgrade to Crypt::OpenSSL::PKCS12 1.98 or later, which sizes the buffer
on the decoded string length plus one and writes an explicit
terminator.
References
----------
https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.98/source/Changes.md
https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/6cb282d8d8e8ded4859551cd2d3cfa7c6028ce48.patch
