A user can pass anything as the tag into gcm_decrypt_verify() and it will return decrypted plaintext.

• https://github.com/DCIT/perl-CryptX/issues/47
• https://github.com/libtom/libtomcrypt/pull/451

CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode. CryptX embeds the tomcrypt library. The versions of that library in CryptX before 0.065 may be susceptible to CVE-2019-17362.

• https://github.com/libtom/libtomcrypt/issues/507

Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow. CryptX embeds a version of the libtommath library that is susceptible to an integer overflow associated with CVE-2023-36328.

• https://github.com/advisories/GHSA-j3xv-6967-cv88
• https://github.com/libtom/libtommath/pull/546
• https://metacpan.org/release/MIK/CryptX-0.086/source/src/ltm/bn_mp_grow.c
• https://www.cve.org/CVERecord?id=CVE-2023-36328