Issue summary: OpenSSL CMP response validation passed an unexpected response
\nsender distinguished name directly as the format string to `ERR_raise_data()`.<\/p>\n
Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client
\nthat enforces an expected sender or uses a pinned server certificate whose
\nsubject becomes the default expected sender.<\/p>\n
CWE: CWE-134 (Use of Externally-Controlled Format String)<\/p>\n
Description: When validating a received CMP message, ossl_cmp_msg_check_update()
\nconverts the peer-supplied sender distinguished name with X509_NAME_oneline()
\nand passes it directly as the format argument to ERR_raise_data(). Percent
\ncharacters survive the conversion, so a sender DN such as “CN=%s%n” reaches
\nBIO_vsnprintf() as an attacker-controlled format string with no matching variadic
\narguments. This path is only reached when the caller configures an expected
\nsender or pins a server certificate, which is the normal configuration for a
\nCMP client validating server responses.<\/p>\n
Since the attacker controls the format string but none of the variadic
\narguments, such specifiers as %s and %n dereference or write through unrelated
\nstack contents and crash the client. The reliable consequence is a denial of
\nservice, when the response comes from a malicious or intercepted CMP endpoint.
\nThere is no controlled memory write, arbitrary-address read, or reliable path
\nto remote code execution.<\/p>\n
FIPS impact: no<\/p>\n
No FIPS modules are affected by this issue, as the CMP protocol
\nimplementation is outside the OpenSSL FIPS module boundary.<\/p>\n","protected":false},"excerpt":{"rendered":"
Issue summary: OpenSSL CMP response validation passed an unexpected response
\nsender distinguished name directly as the format string to `ERR_raise_data()`.<\/p>\n
Impact summary: A malicious or intercepted <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11561","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11561","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11561"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11561"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11561"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}