/ 
Crypt-OpenSSL-PKCS12-0.5
/ Crypt::OpenSSL::PKCS12
Security Advisories (4)
CVE-2026-8507 (2026-05-17)

Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws. When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap out-of-bounds write would be triggered with remote-code-execution potential (RCE) due to a signed integer overflow in the size calculation passed to Renew().

CVE-2026-8721 (2026-05-17)

Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded. The C code (or OpenSSL internally) calls strlen() on the buffer. Any password byte at or after the first NULL is silently dropped. Binary / KDF-derived / HMAC-derived passwords lose entropy without any warnings.

CVE-2026-9265 (2026-06-20)

Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_attribute() copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length via strncpy, leaving no NUL terminator. Downstream callers run strlen() on the result and pass the inflated length to newSVpvn(), copying attacker-influenced adjacent heap bytes into a Perl scalar.

CVE-2026-17510 (2026-08-09)

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute. print_attribute() sizes the destination buffer for a BMPSTRING attribute from its declared byte length with `Renew(*attribute, length, char)`. A zero length attribute makes that a zero size reallocation, which Perl implements as a free returning NULL, so the buffer pointer becomes NULL, the following `strncpy` copies nothing, and the caller dereferences NULL in the `strlen()` it passes to `newSVpvn()`. A zero length BMPSTRING is even length, so the ASN.1 decoder accepts it and the value reaches this code. The UTF8STRING, OCTET STRING and BIT STRING arms size on `length + 1` or `length * 4 + 1` and are unaffected. Any caller that passes an untrusted PKCS#12 file to info_as_hash() can crash the process. info() prints attribute values directly without sizing a buffer and is unaffected.

NAME

Crypt::OpenSSL::PKCS12 - Perl extension to OpenSSL's PKCS12 API.

SYNOPSIS

  use Crypt::OpenSSL::PKCS12;

  my $pass   = "your password";
  my $pkcs12 = Crypt::OpenSSL::PKCS12->new_from_file('cert.p12');

  print $pkcs12->certificate($pass);

  if ($pkcs12->mac_ok($pass)) {
	....

  $pkcs12->create('test-cert.pem', 'test-key.pem', $pass, 'out.p12', "friendly name");

ABSTRACT

Crypt::OpenSSL::PKCS12 - Perl extension to OpenSSL's PKCS12 API.

DESCRIPTION

This implements a small bit of OpenSSL's PKCS12 API.

FUNCTIONS

  • new( )

  • new_from_string( $string )

  • new_from_file( $filename )

    Create a new Crypt::OpenSSL::PKCS12 instance.

  • certificate( [$pass] )

    Get the Base64 representation of the certificate.

  • as_string( [$pass] )

    Get the binary represenation as a string.

  • mac_ok( [$pass] )

    Verifiy the certificates Message Authentication Code

  • changepass( $old, $new )

    Change a certificate's password.

  • create( $cert, $key, $pass, $output_file, $friendly_name )

    Create a new PKCS12 certificate. $cert & $key may either be strings or filenames.

    $friendly_name is optional.

EXPORT

None by default.

On request:

  • NOKEYS

  • NOCERTS

  • INFO

  • CLCERTS

  • CACERTS

SEE ALSO

OpenSSL(1), Crypt::OpenSSL::X509, Crypt::OpenSSL::RSA, Crypt::OpenSSL::Bignum

AUTHOR

Dan Sully, <daniel@cpan.org>

COPYRIGHT AND LICENSE

Copyright 2004-2008 by Dan Sully

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.8.8 or, at your option, any later version of Perl 5 you may have available.