Bob Beck

**Name of the Vulnerable Software and Affected Versions** OpenSSL (affected versions not specified) **Description** An error in the callback used to verify certificates during a Root CA key update in the Certificate Management Protocol (CMP) renders certificate validation ineffectual. Specifically, a typo in the certificate chain building code within the `OSSL CMP get1 rootCaKeyUpdate()` function causes an incorrect certificate (`newWithOld` instead of `oldRoot`) to be added to the chain. This allows an attacker with valid Registration Authority (RA) level credentials to bypass signature verification and replace the root CA certificate for CMP clients with an arbitrary self-signed certificate, effectively escalating credentials to the root Certification Authority level. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenSSL (affected versions not specified) **Description** An out-of-bounds read occurs when an application calls the `X509 VERIFY PARAM set1 email` function to validate a crafted email address, such as during S/MIME message validation. This issue stems from an internal helper function called by `X509 VERIFY PARAM set1 email()` and `X509 VERIFY PARAM add email()` that uses an incorrect length when validating the local part of an email address. Consequently, the 64-octet limit for the local part may not be enforced, potentially leading to a crash and Denial of Service. The flaw is reachable via S-MIME validation using a crafted From: address in an email message. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenSSL versions 1.1.1, 3.0, 3.3, 3.4, and 3.5 OpenSSL versions 3.6 through 3.6.0 **Description** An invalid or NULL pointer dereference can occur in applications processing malformed PKCS#12 files. This can lead to a denial of service when an application attempts to read from an invalid or NULL pointer in memory. The issue stems from a type confusion in the PKCS#12 parsing code, where an ASN1 TYPE union member is accessed without prior type validation, resulting in an invalid pointer read. The vulnerability is constrained to a 1-byte address space, which typically results in a crash due to unmapped memory on modern operating systems. Exploitation requires processing a maliciously crafted PKCS#12 file. **Recommendations** OpenSSL version 1.1.1: At the moment, there is no information about a newer version that contains a fix for this vulnerability. OpenSSL versions 3.0, 3.3, and 3.4: At the moment, there is no information about a newer version that contains a fix for this vulnerability. OpenSSL versions 3.5 through 3.5.4: Update to version 3.5.5. OpenSSL versions 3.6 through 3.6.0: Update to version 3.6.1.

**Name of the Vulnerable Software and Affected Versions** OpenSSL versions 1.0.2 through 3.6 **Description** A type confusion issue exists in the signature verification of signed PKCS#7 data. This occurs when an ASN1 TYPE union member is accessed without first validating the type, potentially leading to an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Exploiting this requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of exploitation is a denial-of-service. The vulnerable code is within the `PKCS7 digest from attributes()` function, which accesses the message digest attribute value without validating its type. This can result in accessing invalid memory through the ASN1 TYPE union, causing a crash. The PKCS7 API is considered legacy, and applications should use the CMS API instead. **Recommendations** OpenSSL version 1.0.2: Update to a newer version. OpenSSL versions 1.1.1 through 3.6: Update to the latest version.

**Name of the Vulnerable Software and Affected Versions** Tomcat versions (affected versions not specified) FortiCup Administrative Interface (affected versions not specified) **Description** The issue is related to a Denial of Service (DoS) condition that can be triggered by a specially crafted HTTP request, potentially causing the service to crash. It is also described as a "Coffee Overflow" in the context of the FortiCup Administrative Interface, though the exact nature of this overflow is not specified. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** For Tomcat, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For FortiCup Administrative Interface, at the moment, there is no information about a newer version that contains a fix for this vulnerability.