EUVD-2026-30707
GHSA-hh8h-hxcj-2pm7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl truncates passwords with embedded NULLs.
Password parameters in PKCS12.xs are declared char *, which routes through Perl's default typemap to SvPV_nolen. The Perl length is discarded.
The C code (or OpenSSL internally) calls strlen() on the buffer. Any password byte at or after the first NULL is silently dropped. Binary / KDF-derived / HMAC-derived passwords lose entropy without any warnings.
AnalysisAI
Silent password truncation in the Perl module Crypt::OpenSSL::PKCS12 versions up to and including 1.94 causes any password bytes at or after the first embedded NULL byte to be dropped without warning. The flaw stems from password parameters being declared as char* in PKCS12.xs, routing through Perl's default typemap to SvPV_nolen and discarding the Perl-known length before C strlen() truncates the buffer. The result is severe entropy loss for binary, KDF-derived, or HMAC-derived passwords used to protect PKCS12 keystores, with no public exploit identified at time of analysis.
Technical ContextAI
Crypt::OpenSSL::PKCS12 is a CPAN module providing Perl bindings to OpenSSL's PKCS#12 keystore handling (parsing, creating, and decrypting .p12/.pfx files containing private keys and certificate chains). The defect lives in the XS glue layer (PKCS12.xs): because password parameters are typed as char*, Perl's default typemap converts SV scalars using SvPV_nolen, which yields a NUL-terminated C string and discards the SvCUR length Perl already knows. When the underlying C code or OpenSSL routines (e.g., PKCS12_create, PKCS12_parse) subsequently invoke strlen() on that buffer, any byte from the first 0x00 onward is silently lost before reaching the PKCS#12 key derivation function. This is a textbook CWE-170 (Improper Null Termination) issue and effectively becomes a cryptographic entropy-truncation bug whenever the caller passes raw binary key material - for example, the output of HKDF, HMAC, or a hash function - as the PKCS12 password.
RemediationAI
Upgrade to Crypt::OpenSSL::PKCS12 version 1.95 or later, which is referenced as the fixed release on MetaCPAN (https://metacpan.org/release/JONASBN/Crypt-OpenSSL-PKCS12-1.95/view/Changes.md); consult the oss-security disclosure at http://www.openwall.com/lists/oss-security/2026/05/17/6 and the VulDB advisory at https://vuldb.com/vuln/364433 for additional context. As a compensating control until the upgrade lands, callers should ensure passwords passed to PKCS12 routines are restricted to NUL-free byte sequences - for example, hex- or base64-encode any binary/KDF-derived key material before passing it in, which avoids the truncation entirely at the cost of requiring symmetric encoding on the consumer side. Audit any PKCS12 files previously generated with binary passwords and re-export them under the patched module with safe encodings, because existing keystores retain the weakened entropy until rekeyed.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
The dtls1_reassemble_fragment function in d1_both.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to se
The ssl3_get_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8zd, 1.0.0 before 1.0.0p, and 1.0.1 before 1.0.1k
The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which mak
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
The X509_verify_cert function in crypto/x509/x509_vfy.c in OpenSSL 1.0.1n, 1.0.1o, 1.0.2b, and 1.0.2c does not properly
A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Rated hig
The ssl3_send_client_key_exchange function in s3_clnt.c in OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before
In OpenSSL 1.1.0 before 1.1.0d, if a malicious server supplies bad parameters for a DHE or ECDHE key exchange then this
A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL proto
Same weakness CWE-170 – Improper Null Termination
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today