/ 
Crypt-OpenSSL-X509-0.3.1
/ Crypt::OpenSSL::X509
Security Advisories (2)
CVE-2026-58101 (2026-07-13)

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow denial of service via NULL pointer dereference. X509V3_EXT_d2i(ext) returns NULL when an extension's DER value fails to parse. basicC, ia5string, and auth_att dereference its result without a NULL check. keyid_data also dereferences akid->keyid, which is NULL for an empty AKI SEQUENCE (DER 30 00) even when the parse succeeds. A caller invoking an affected helper on an extension from an untrusted certificate triggers a SIGSEGV that crashes the Perl process.

CVE-2026-58102 (2026-07-13)

Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds read via a long certificate extension OID in hv_exts. When building the extension hash (via extensions(), extensions_by_long_name(), extensions_by_oid(), or has_extension_oid()), the code passes OBJ_obj2txt()'s return value as the hash-key length; because that value is the OID's full text length rather than the bytes written to the fixed-size buffer (129 bytes), an OID whose text is longer than the 129-byte buffer causes a read past the allocation, exposing adjacent heap memory as the returned hash key. extensions_by_name() uses the static shortname path and is not affected.

NAME

Crypt::OpenSSL::X509 - Perl extension to OpenSSL's X509 API.

SYNOPSIS

use Crypt::OpenSSL::X509;

my $x509 = Crypt::OpenSSL::X509->new_from_file('cert.pem');

print $x509->pubkey() . "\n";
print $x509->subject() . "\n";
print $x509->issuer() . "\n";
print $x509->email() . "\n";
print $x509->hash() . "\n";
print $x509->notBefore() . "\n";
print $x509->notAfter() . "\n";

ABSTRACT

Crypt::OpenSSL::X509 - Perl extension to OpenSSL's X509 API.

DESCRIPTION

This implement a large majority of OpenSSL's useful X509 API.

The email() method supports both certificates where the
subject is of the form: 
"... CN=Firstname lastname/emailAddress=user@domain", and also 
certificates where there is a X509v3 Extension of the form 
"X509v3 Subject Alternative Name: email=user@domain".

EXPORT

None by default.

On request:

FORMAT_UNDEF FORMAT_ASN1 FORMAT_TEXT FORMAT_PEM FORMAT_NETSCAPE
FORMAT_PKCS12 FORMAT_SMIME FORMAT_ENGINE FORMAT_IISSGC

SEE ALSO

OpenSSL(1), Crypt::OpenSSL::RSA, Crypt::OpenSSL::Bignum

AUTHOR

Dan Sully, <daniel@cpan.org>

COPYRIGHT AND LICENSE

Copyright 2004 by Daniel Sully

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself.