PT-2026-47856 · Openssl+4 · Openssl+4
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
OpenSSL (affected versions not specified)
Description
A heap out-of-bounds read can occur during CMS password-based decryption (RFC 3211 / PWRI key unwrap) when processing attacker-supplied CMS data. The issue arises in the
kek unwrap key() function when an attacker selects a stream-mode Key Encryption Key (KEK) cipher via an OID in the keyEncryptionAlgorithm. Because the system does not require the cipher to be a block cipher, the minimum length check is bypassed, allowing the allocated buffer for the unwrapped key to be too small for the RFC-specified check-bytes. This can lead to a crash and subsequent Denial of Service if the input buffer ends at a memory page boundary and the following page is unmapped. Applications using CMS decrypt() or CMS decrypt set1 password() on untrusted data are affected. No password knowledge is required to trigger this issue. FIPS modules are not affected.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Freebsd
Linuxmint
Openssl
Rocky Linux
Ubuntu