[<prev] [day] [month] [year] [list]
Message-ID: <804e09e7d8f96e8f3f16bc1c0c5b1fe2@cpansec.org>
Date: Sun, 17 May 2026 15:50:47 -0300
From: Timothy Legge <timlegge@...nsec.org>
To: Cve Announce <cve-announce@...urity.metacpan.org>, Oss Security
<oss-security@...ts.openwall.com>
Subject: CVE-2026-8721: Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl
truncates passwords with embedded NULLs
========================================================================
CVE-2026-8721 CPAN Security Group
========================================================================
CVE ID: CVE-2026-8721
Distribution: Crypt-OpenSSL-PKCS12
Versions: through 1.94
MetaCPAN: https://metacpan.org/dist/Crypt-OpenSSL-PKCS12
VCS Repo: https://github.com/dsully/perl-crypt-openssl-pkcs12
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates
passwords with embedded NULLs
Description
-----------
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates
passwords with embedded NULLs.
Password parameters in PKCS12.xs are declared char *, which routes
through Perl's default typemap to SvPV_nolen. The Perl length is
discarded.
The C code (or OpenSSL internally) calls strlen() on the buffer. Any
password byte at or after the first NULL is silently dropped. Binary /
KDF-derived / HMAC-derived passwords lose entropy without any warnings.
Problem types
-------------
- CWE-170 Improper Null Termination
Solutions
---------
Upgrade to 1.95 or later.
References
----------
https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.95/view/Changes.md
Timeline
--------
- 2026-05-13: CPANSec identified issue
- 2026-05-13: Author was notified
- 2026-05-17: Maintainer released patch version
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
