| Name | CVE-2026-17510 |
| Description | Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute. print_attribute() sizes the destination buffer for a BMPSTRING attribute from its declared byte length with `Renew(*attribute, length, char)`. A zero length attribute makes that a zero size reallocation, which Perl implements as a free returning NULL, so the buffer pointer becomes NULL, the following `strncpy` copies nothing, and the caller dereferences NULL in the `strlen()` it passes to `newSVpvn()`. A zero length BMPSTRING is even length, so the ASN.1 decoder accepts it and the value reaches this code. The UTF8STRING, OCTET STRING and BIT STRING arms size on `length + 1` or `length * 4 + 1` and are unaffected. Any caller that passes an untrusted PKCS#12 file to info_as_hash() can crash the process. info() prints attribute values directly without sizing a buffer and is unaffected. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1143970 |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| libcrypt-openssl-pkcs12-perl (PTS) | bullseye | 1.3-1 | vulnerable |
| trixie | 1.94-1 | vulnerable | |
| forky | 1.98-1 | fixed | |
| sid | 1.99-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| libcrypt-openssl-pkcs12-perl | source | (unstable) | 1.98-1 | 1143970 |
[trixie] - libcrypt-openssl-pkcs12-perl <no-dsa> (Minor issue)
[bookworm] - libcrypt-openssl-pkcs12-perl <postponed> (Minor issue)
[bullseye] - libcrypt-openssl-pkcs12-perl <postponed> (Minor issue)
https://lists.security.metacpan.org/cve-announce/msg/42524422/
Fixed by: https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/6cb282d8d8e8ded4859551cd2d3cfa7c6028ce48 (v1.98)