[<prev] [next>] [day] [month] [year] [list]
Message-ID: <755ef91e2e9d25d89cd37fc6879de83d@cpansec.org>
Date: Sun, 17 May 2026 15:44:39 -0300
From: Timothy Legge <timlegge@...nsec.org>
To: Cve Announce <cve-announce@...urity.metacpan.org>, Oss Security
<oss-security@...ts.openwall.com>
Subject: CVE-2026-8507: Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl
have out of bound (OOB) write flaws
========================================================================
CVE-2026-8507 CPAN Security Group
========================================================================
CVE ID: CVE-2026-8507
Distribution: Crypt-OpenSSL-PKCS12
Versions: through 1.94
MetaCPAN: https://metacpan.org/dist/Crypt-OpenSSL-PKCS12
VCS Repo: https://github.com/dsully/perl-crypt-openssl-pkcs12
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out of bound
(OOB) write flaws
Description
-----------
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out of bound
(OOB) write flaws.
When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT
STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a
heap-OOB-WRITE would be triggered which could have Remote Code
Execution (RCE) potential.
Problem types
-------------
- CWE-787 Out-of-bounds Write
Workarounds
-----------
Do not parse untrusted PKCS12 files via info or info_as_hash.
Solutions
---------
Upgrade to 1.95 or later.
References
----------
https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.95/view/Changes.md
https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/55
https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/56
https://github.com/dsully/perl-crypt-openssl-pkcs12/commit/b9d0469c6d8f5b5c6c2a45a3d0647a532b749397.patch
Timeline
--------
- 2026-05-13: Issue discovered
- 2026-05-16: Contacted maintainer with the details
- 2026-05-17: Issue disclosed in Github incident
- 2026-05-17: Patched version released by maintainer
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
