CVE-2026-17510

{
  "id": "CVE-2026-17510",
  "sourceIdentifier": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
  "published": "2026-08-09T02:16:34.117",
  "lastModified": "2026-10-23T20:10:00.160",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute.\n\nprint_attribute() sizes the destination buffer for a BMPSTRING attribute from its declared byte length with `Renew(*attribute, length, char)`. A zero length attribute makes that a zero size reallocation, which Perl implements as a free returning NULL, so the buffer pointer becomes NULL, the following `strncpy` copies nothing, and the caller dereferences NULL in the `strlen()` it passes to `newSVpvn()`. A zero length BMPSTRING is even length, so the ASN.1 decoder accepts it and the value reaches this code. The UTF8STRING, OCTET STRING and BIT STRING arms size on `length + 1` or `length * 4 + 1` and are unaffected.\n\nAny caller that passes an untrusted PKCS#12 file to info_as_hash() can crash the process. info() prints attribute values directly without sizing a buffer and is unaffected."
    },
    {
      "lang": "es",
      "value": "Crypt::OpenSSL::PKCS12 versiones anteriores a 1.98 para Perl permiten una desreferencia de puntero NULL en print_attribute a través de un atributo BMPSTRING de longitud cero.\n\nprint_attribute() dimensiona el búfer de destino para un atributo BMPSTRING a partir de su longitud en bytes declarada con ’Renew(attribute, length, char)’. Un atributo de longitud cero hace que sea una reasignación de tamaño cero, que Perl implementa como una liberación que devuelve NULL, por lo que el puntero del búfer se vuelve NULL, el siguiente ’strncpy’ no copia nada, y el llamador desreferencia NULL en el ’strlen()’ que pasa a ’newSVpvn()’. Un BMPSTRING de longitud cero tiene una longitud par, por lo que el decodificador ASN.1 lo acepta y el valor llega a este código. Las ramas UTF8STRING, OCTET STRING y BIT STRING dimensionan con ’length + 1’ o ’length * 4 + 1’ y no se ven afectadas.\n\nCualquier llamador que pase un archivo PKCS#12 no confiable a info_as_hash() puede bloquear el proceso. info() imprime los valores de los atributos directamente sin dimensionar un búfer y no se ve afectada."
    }
  ],
  "affected": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "affectedData": [
        {
          "vendor": "JONASBN",
          "product": "Crypt::OpenSSL::PKCS12",
          "defaultStatus": "unaffected",
          "collectionURL": "https://cpan.org/modules",
          "packageName": "Crypt-OpenSSL-PKCS12",
          "programFiles": [
            "PKCS12.xs"
          ],
          "programRoutines": [
            {
              "name": "Crypt::OpenSSL::PKCS12::info_as_hash"
            }
          ],
          "repo": "https://github.com/dsully/perl-crypt-openssl-pkcs12",
          "versions": [
            {
              "version": "0",
              "lessThan": "1.98",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-12T17:35:51.161155Z",
          "id": "CVE-2026-17510",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/6cb282d8d8e8ded4859551cd2d3cfa7c6028ce48.patch",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.98/source/Changes.md",
      "source": "9b29abf9-4ab0-4765-b253-1875cd9b441e"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/08/09/1",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}