package pkcs12: Authentication bypass in Decode functions

Decode, DecodeChain, DecodeTrustStore, and ToPEM can incorrectly accept PKCS12 files which were encoded with the wrong password, due to a failure to reject excessively-short PBMAC1 keys. Users who decode PKCS12 files from untrusted sources and rely on the password for authentication can be tricke...

EUVD-2026-57209

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive mode=export action in modules/sso/keys.php exports a PKCS12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an...

CVE-2026-47232

Admidio is an open-source user management solution. Prior to version 5.0.10, the sensitive mode=export action in modules/sso/keys.php exports a PKCS12 bundle containing the configured private key and certificate, but the CSRF validation line is commented out. A forged cross-site POST from an...

DEBIAN-CVE-2026-17510

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renewattribute, length, char. A zero length...

CVE-2026-17510

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renewattribute, length, char. A zero length...

UBUNTU-CVE-2026-17510

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renewattribute, length, char. A zero length...

CVE-2026-17510

CVE-2026-17510 affects Crypt::OpenSSL::PKCS12 for Perl prior to 1.98. The vulnerability is a NULL pointer dereference in print_attribute when processing a zero-length BMPSTRING attribute in PKCS#12 data, potentially crashing any process that ingests an untrusted PKCS#12 via info_as_hash(). The is...

CVE-2026-17510 Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renewattribute, length, char. A zero length...

CVE-2026-17510

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in printattribute via a zero length BMPSTRING attribute. printattribute sizes the destination buffer for a BMPSTRING attribute from its declared byte length with Renewattribute, length, char. A zero length...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12 file's MAC data and encrypted bags into key derivation during engineLoad without enforcing...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12 file's MAC data and encrypted bags into key derivation during engineLoad without enforcing...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12 file's MAC data and encrypted bags into key derivation during engineLoad without enforcing...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12 file's MAC data and encrypted bags into key derivation during engineLoad without enforcing...

Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-jdk14 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12 file's...

Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-jdk15 is a package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5. Affected versions of this package are vulnerable to Allocation of Resources Without...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in JcePKCSPBEInputDecryptorProviderBuilder and JceOpenSSLPKCS8DecryptorProviderBuilder, which parse PBES2Parameters from attacker-supplied EncryptedPrivateKeyInfo, PKCS12, or CMS...

Updated openssl packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion. CVE-2026-7383 Out-of-Bounds Read in CMS Password-Based Decryption. CVE-2026-9076 Heap Buffer Over-read in ASN.1 Content Parsing. CVE-2026-34180 PKCS12 Files with PBMAC1 Are...

SUSE-SU-2026:2924-1 Security update for gnutls

This update for gnutls fixes the following issues - CVE-2026-3833: incorrectly accepted domain names due to comparison during name constraints processing being case-sensitive bsc1263707. - CVE-2026-5260: heap overread when processing extremely short premaster secret as part of an RSA key exchange...

SUSE-SU-2026:2923-1 Security update for gnutls

This update for gnutls fixes the following issues - CVE-2026-3833: incorrectly accepted domain names due to comparison during name constraints processing being case-sensitive bsc1263707. - CVE-2026-5260: heap overread when processing extremely short premaster secret as part of an RSA key exchange...

The vulnerability of the gnutls_pkcs12_bag_set_data() function in the GnuTLS cryptographic library allows a attacker to damage memory or cause service failures.

The vulnerability of the gnutlspkcs12bagsetdata function in the GnuTLS cryptographic library is related to a single-precision shift error. Exploiting this vulnerability could allow an attacker to corrupt memory or cause service failures...