/ 
Crypt-OpenSSL-PKCS12-1.11-TRIAL
⭐ Starred 10 / Crypt::OpenSSL::PKCS12
Security Advisories (4)
CVE-2026-8507 (2026-05-17)

Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws. When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap out-of-bounds write would be triggered with remote-code-execution potential (RCE) due to a signed integer overflow in the size calculation passed to Renew().

CVE-2026-8721 (2026-05-17)

Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs. Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded. The C code (or OpenSSL internally) calls strlen() on the buffer. Any password byte at or after the first NULL is silently dropped. Binary / KDF-derived / HMAC-derived passwords lose entropy without any warnings.

CVE-2026-9265 (2026-06-20)

Crypt::OpenSSL::PKCS12 versions before 1.96 for Perl permits a heap OOB read in print_attribute UTF8STRING path. print_attribute() copies a UTF8STRING ASN.1 attribute value into a heap buffer sized exactly to its declared length via strncpy, leaving no NUL terminator. Downstream callers run strlen() on the result and pass the inflated length to newSVpvn(), copying attacker-influenced adjacent heap bytes into a Perl scalar.

CVE-2026-17510 (2026-08-09)

Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute. print_attribute() sizes the destination buffer for a BMPSTRING attribute from its declared byte length with `Renew(*attribute, length, char)`. A zero length attribute makes that a zero size reallocation, which Perl implements as a free returning NULL, so the buffer pointer becomes NULL, the following `strncpy` copies nothing, and the caller dereferences NULL in the `strlen()` it passes to `newSVpvn()`. A zero length BMPSTRING is even length, so the ASN.1 decoder accepts it and the value reaches this code. The UTF8STRING, OCTET STRING and BIT STRING arms size on `length + 1` or `length * 4 + 1` and are unaffected. Any caller that passes an untrusted PKCS#12 file to info_as_hash() can crash the process. info() prints attribute values directly without sizing a buffer and is unaffected.

NAME

Crypt::OpenSSL::PKCS12 - Perl extension to OpenSSL's PKCS12 API.

SYNOPSIS

use Crypt::OpenSSL::PKCS12;

my $pass   = "your password";
my $pkcs12 = Crypt::OpenSSL::PKCS12->new_from_file('cert.p12');

print $pkcs12->certificate($pass);
print $pkcs12->private_key($pass);

if ($pkcs12->mac_ok($pass)) {
...

# Creating a file
$pkcs12->create('test-cert.pem', 'test-key.pem', $pass, 'out.p12', 'friendly name');


# Creating a string
my $pksc12_data = $pkcs12->create_as_string('test-cert.pem', 'test-key.pem', $pass, 'friendly name');

VERSION

This documentation describes version 1.9

DESCRIPTION

PKCS12 is a file format for storing cryptography objects as a single file or string. PKCS12 is commonly used to bundle a private key with its X.509 certificate or to bundle all the members of a chain of trust.

This distribution implements a subset of OpenSSL's PKCS12 API.

SUBROUTINES/METHODS

  • new( )

  • new_from_string( $string )

  • new_from_file( $filename )

    Create a new Crypt::OpenSSL::PKCS12 instance.

  • certificate( [$pass] )

    Get the Base64 representation of the certificate.

  • private_key( [$pass] )

    Get the Base64 representation of the private key.

  • as_string( [$pass] )

    Get the binary represenation as a string.

  • mac_ok( [$pass] )

    Verifiy the certificates Message Authentication Code

  • changepass( $old, $new )

    Change a certificate's password.

  • create( $cert, $key, $pass, $output_file, $friendly_name )

    Create a new PKCS12 certificate. $cert & $key may either be strings or filenames.

    $friendly_name is optional.

  • create_as_string( $cert, $key, $pass, $friendly_name )

    Create a new PKCS12 certificate string. $cert & $key may either be strings or filenames.

    $friendly_name is optional.

    Returns a string holding the PKCS12 certicate.

EXPORTS

None by default.

On request:

  • NOKEYS

  • NOCERTS

  • INFO

  • CLCERTS

  • CACERTS

DIAGNOSTICS

No diagnostics are documented at this time

CONFIGURATION AND ENVIRONMENT

No special environment or configuration is required.

DEPENDENCIES

This distribution has the following dependencies

  • An installation of OpenSSL, either version 1.X.X or version 3.X.X

  • Perl 5.8

SEE ALSO

INCOMPATIBILITIES

Currently the library has been updated to support both OpenSSL 1.X.X and OpenSSL 3.X.X

BUGS AND LIMITATIONS

Please see the GitHub repository for known issues.

AUTHOR

  • Dan Sully, <daniel@cpan.org>

Current maintainer

  • jonasbn

CONTRIBUTORS

In alphabetical order, contributors, bug reporters and all

  • @mmuehlenhoff

  • @sectokia

  • @SmartCodeMaker

  • Alexandr Ciornii, @chorny

  • Christopher Hoskin, @mans0954

  • Daisuke Murase, @typester

  • Darko Prelec, @dprelec

  • David Steinbrunner, @dsteinbrunner

  • Giuseppe Di Terlizzi, @giterlizzi

  • H.Merijn Brand, @tux

  • Hakim, @osfameron

  • J. Nick Koston, @bdraco

  • James Rouzier, @jrouzierinverse

  • jonasbn. @jonasbn

  • Kelson, @kelson42

  • Lance Wicks, @lancew

  • Leonid Antonenkov

  • Masayuki Matsuki, @songmu

  • Mikołaj Zalewski

  • Shoichi Kaji

  • Slaven Rezić

  • Timothy Legge, @timlegge

  • Todd Rinaldo, @toddr

LICENSE AND COPYRIGHT

Copyright 2004-2024 by Dan Sully

This library is free software; you can redistribute it and/or modify it under the same terms as Perl itself, either Perl version 5.8.8 or, at your option, any later version of Perl 5 you may have available.