CVE-2026-17510

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-17510", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "state": "PUBLISHED", "assignerShortName": "CPANSec", "dateReserved": "2026-07-27T00:17:17.758Z", "datePublished": "2026-08-09T01:21:30.439Z", "dateUpdated": "2026-08-12T17:35:54.067Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Crypt-OpenSSL-PKCS12", "product": "Crypt::OpenSSL::PKCS12", "programFiles": ["PKCS12.xs"], "programRoutines": [{"name": "Crypt::OpenSSL::PKCS12::info_as_hash"}], "repo": "https://github.com/dsully/perl-crypt-openssl-pkcs12", "vendor": "JONASBN", "versions": [{"lessThan": "1.98", "status": "affected", "version": "0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute.\n\nprint_attribute() sizes the destination buffer for a BMPSTRING attribute from its declared byte length with `Renew(*attribute, length, char)`. A zero length attribute makes that a zero size reallocation, which Perl implements as a free returning NULL, so the buffer pointer becomes NULL, the following `strncpy` copies nothing, and the caller dereferences NULL in the `strlen()` it passes to `newSVpvn()`. A zero length BMPSTRING is even length, so the ASN.1 decoder accepts it and the value reaches this code. The UTF8STRING, OCTET STRING and BIT STRING arms size on `length + 1` or `length * 4 + 1` and are unaffected.\n\nAny caller that passes an untrusted PKCS#12 file to info_as_hash() can crash the process. info() prints attribute values directly without sizing a buffer and is unaffected."}], "problemTypes": [{"descriptions": [{"cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-08-09T01:21:30.439Z"}, "references": [{"tags": ["release-notes"], "url": "https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.98/source/Changes.md"}, {"tags": ["patch"], "url": "https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/6cb282d8d8e8ded4859551cd2d3cfa7c6028ce48.patch"}], "solutions": [{"lang": "en", "value": "Upgrade to Crypt::OpenSSL::PKCS12 1.98 or later, which sizes the buffer on the decoded string length plus one and writes an explicit terminator."}], "source": {"discovery": "UNKNOWN"}, "title": "Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute", "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade to 1.98, ensure that PKCS#12 files passed to info_as_hash() come from trusted sources."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/09/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-09T03:32:58.521Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-08-12T17:35:51.161155Z", "id": "CVE-2026-17510", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T17:35:54.067Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/08/09/1"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-08-09T03:32:58.521Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-17510", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T17:35:51.161155Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-12T17:35:44.664Z"}}], "cna": {"title": "Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute", "source": {"discovery": "UNKNOWN"}, "affected": [{"repo": "https://github.com/dsully/perl-crypt-openssl-pkcs12", "vendor": "JONASBN", "product": "Crypt::OpenSSL::PKCS12", "versions": [{"status": "affected", "version": "0", "lessThan": "1.98", "versionType": "custom"}], "packageName": "Crypt-OpenSSL-PKCS12", "programFiles": ["PKCS12.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Crypt::OpenSSL::PKCS12::info_as_hash"}]}], "solutions": [{"lang": "en", "value": "Upgrade to Crypt::OpenSSL::PKCS12 1.98 or later, which sizes the buffer on the decoded string length plus one and writes an explicit terminator."}], "references": [{"url": "https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.98/source/Changes.md", "tags": ["release-notes"]}, {"url": "https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/6cb282d8d8e8ded4859551cd2d3cfa7c6028ce48.patch", "tags": ["patch"]}], "workarounds": [{"lang": "en", "value": "For deployments that cannot upgrade to 1.98, ensure that PKCS#12 files passed to info_as_hash() come from trusted sources."}], "x_generator": {"engine": "cpansec-cna-tool 0.1"}, "descriptions": [{"lang": "en", "value": "Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute.\n\nprint_attribute() sizes the destination buffer for a BMPSTRING attribute from its declared byte length with `Renew(*attribute, length, char)`. A zero length attribute makes that a zero size reallocation, which Perl implements as a free returning NULL, so the buffer pointer becomes NULL, the following `strncpy` copies nothing, and the caller dereferences NULL in the `strlen()` it passes to `newSVpvn()`. A zero length BMPSTRING is even length, so the ASN.1 decoder accepts it and the value reaches this code. The UTF8STRING, OCTET STRING and BIT STRING arms size on `length + 1` or `length * 4 + 1` and are unaffected.\n\nAny caller that passes an untrusted PKCS#12 file to info_as_hash() can crash the process. info() prints attribute values directly without sizing a buffer and is unaffected."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-476", "description": "CWE-476 NULL Pointer Dereference"}]}], "providerMetadata": {"orgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "shortName": "CPANSec", "dateUpdated": "2026-08-09T01:21:30.439Z"}}}, "cveMetadata": {"cveId": "CVE-2026-17510", "state": "PUBLISHED", "dateUpdated": "2026-08-12T17:35:54.067Z", "dateReserved": "2026-07-27T00:17:17.758Z", "assignerOrgId": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "datePublished": "2026-08-09T01:21:30.439Z", "assignerShortName": "CPANSec"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "packageName": "Crypt-OpenSSL-PKCS12", "product": "Crypt::OpenSSL::PKCS12", "programFiles": ["PKCS12.xs"], "programRoutines": [{"name": "Crypt::OpenSSL::PKCS12::info_as_hash"}], "repo": "https://github.com/dsully/perl-crypt-openssl-pkcs12", "vendor": "JONASBN", "versions": [{"lessThan": "1.98", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute.\n\nprint_attribute() sizes the destination buffer for a BMPSTRING attribute from its declared byte length with `Renew(*attribute, length, char)`. A zero length attribute makes that a zero size reallocation, which Perl implements as a free returning NULL, so the buffer pointer becomes NULL, the following `strncpy` copies nothing, and the caller dereferences NULL in the `strlen()` it passes to `newSVpvn()`. A zero length BMPSTRING is even length, so the ASN.1 decoder accepts it and the value reaches this code. The UTF8STRING, OCTET STRING and BIT STRING arms size on `length + 1` or `length * 4 + 1` and are unaffected.\n\nAny caller that passes an untrusted PKCS#12 file to info_as_hash() can crash the process. info() prints attribute values directly without sizing a buffer and is unaffected."}, {"lang": "es", "value": "Crypt::OpenSSL::PKCS12 versiones anteriores a 1.98 para Perl permiten una desreferencia de puntero NULL en print_attribute a trav\u00e9s de un atributo BMPSTRING de longitud cero.\n\nprint_attribute() dimensiona el b\u00fafer de destino para un atributo BMPSTRING a partir de su longitud en bytes declarada con \u2019Renew(attribute, length, char)\u2019. Un atributo de longitud cero hace que sea una reasignaci\u00f3n de tama\u00f1o cero, que Perl implementa como una liberaci\u00f3n que devuelve NULL, por lo que el puntero del b\u00fafer se vuelve NULL, el siguiente \u2019strncpy\u2019 no copia nada, y el llamador desreferencia NULL en el \u2019strlen()\u2019 que pasa a \u2019newSVpvn()\u2019. Un BMPSTRING de longitud cero tiene una longitud par, por lo que el decodificador ASN.1 lo acepta y el valor llega a este c\u00f3digo. Las ramas UTF8STRING, OCTET STRING y BIT STRING dimensionan con \u2019length + 1\u2019 o \u2019length * 4 + 1\u2019 y no se ven afectadas.\n\nCualquier llamador que pase un archivo PKCS#12 no confiable a info_as_hash() puede bloquear el proceso. info() imprime los valores de los atributos directamente sin dimensionar un b\u00fafer y no se ve afectada."}], "id": "CVE-2026-17510", "lastModified": "2026-10-23T20:10:00.160", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17510", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-12T17:35:51.161155Z", "version": "2.0.3"}}]}, "published": "2026-08-09T02:16:34.117", "references": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/6cb282d8d8e8ded4859551cd2d3cfa7c6028ce48.patch"}, {"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "url": "https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.98/source/Changes.md"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/08/09/1"}], "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.98)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Crypt::OpenSSL::PKCS12", "source": "cna", "vendor": "JONASBN"}, "product": "crypt::openssl::pkcs12", "vendor": "jonasbn"}], "created": "2026-08-09T03:00:11.954190+00:00", "updated": "2026-08-13T09:30:07.093793+00:00", "vendors": ["jonasbn", "jonasbn$PRODUCT$crypt::openssl::pkcs12"]}