CVE-2026-17510

{"id": "CVE-2026-17510", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-17510", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-12T17:35:51.161155Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "affectedData": [{"repo": "https://github.com/dsully/perl-crypt-openssl-pkcs12", "vendor": "JONASBN", "product": "Crypt::OpenSSL::PKCS12", "versions": [{"status": "affected", "version": "0", "lessThan": "1.98", "versionType": "custom"}], "packageName": "Crypt-OpenSSL-PKCS12", "programFiles": ["PKCS12.xs"], "collectionURL": "https://cpan.org/modules", "defaultStatus": "unaffected", "programRoutines": [{"name": "Crypt::OpenSSL::PKCS12::info_as_hash"}]}]}], "published": "2026-08-09T02:16:34.117", "references": [{"url": "https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/6cb282d8d8e8ded4859551cd2d3cfa7c6028ce48.patch", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.98/source/Changes.md", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/09/1", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute.\n\nprint_attribute() sizes the destination buffer for a BMPSTRING attribute from its declared byte length with `Renew(*attribute, length, char)`. A zero length attribute makes that a zero size reallocation, which Perl implements as a free returning NULL, so the buffer pointer becomes NULL, the following `strncpy` copies nothing, and the caller dereferences NULL in the `strlen()` it passes to `newSVpvn()`. A zero length BMPSTRING is even length, so the ASN.1 decoder accepts it and the value reaches this code. The UTF8STRING, OCTET STRING and BIT STRING arms size on `length + 1` or `length * 4 + 1` and are unaffected.\n\nAny caller that passes an untrusted PKCS#12 file to info_as_hash() can crash the process. info() prints attribute values directly without sizing a buffer and is unaffected."}, {"lang": "es", "value": "Crypt::OpenSSL::PKCS12 versiones anteriores a 1.98 para Perl permiten una desreferencia de puntero NULL en print_attribute a trav\u00e9s de un atributo BMPSTRING de longitud cero.\n\nprint_attribute() dimensiona el b\u00fafer de destino para un atributo BMPSTRING a partir de su longitud en bytes declarada con \u2019Renew(attribute, length, char)\u2019. Un atributo de longitud cero hace que sea una reasignaci\u00f3n de tama\u00f1o cero, que Perl implementa como una liberaci\u00f3n que devuelve NULL, por lo que el puntero del b\u00fafer se vuelve NULL, el siguiente \u2019strncpy\u2019 no copia nada, y el llamador desreferencia NULL en el \u2019strlen()\u2019 que pasa a \u2019newSVpvn()\u2019. Un BMPSTRING de longitud cero tiene una longitud par, por lo que el decodificador ASN.1 lo acepta y el valor llega a este c\u00f3digo. Las ramas UTF8STRING, OCTET STRING y BIT STRING dimensionan con \u2019length + 1\u2019 o \u2019length * 4 + 1\u2019 y no se ven afectadas.\n\nCualquier llamador que pase un archivo PKCS#12 no confiable a info_as_hash() puede bloquear el proceso. info() imprime los valores de los atributos directamente sin dimensionar un b\u00fafer y no se ve afectada."}], "lastModified": "2026-10-23T20:10:00.160", "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e"}