Issue summary: OpenSSL CMP password based protection verification only
\nchecks whether the protectionAlg parameter was not NULL and not its
\nASN.1 type, before treating it as a PBMParameter. A crafted message can
\ncontain a parameter of a different type, which is then dereferenced as an
\ninvalid pointer.<\/p>\n
Impact summary: A remote, unauthenticated attacker can crash an application
\nacting as a CMP server that accepts PBM-protected messages, or a CMP client
\ntalking to a malicious or intercepted CMP server, resulting in a Denial of
\nService.<\/p>\n
CWE: CWE-476: NULL Pointer Dereference<\/p>\n
Description: When verifying the password-based MAC protection of a CMP
\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with
\nX509_ALGOR_get0(), which returns both the parameter type and its value
\npointer. The value is then cast to an ASN1_STRING and treated as the
\nexpected PBMParameter after only checking that pointer is not NULL. The
\nparameter type returned by X509_ALGOR_get0() was never consulted.<\/p>\n
This happens during protection verification, before any MAC is computed, so
\nno knowledge of the PBM shared secret is required; the only precondition is
\nthat PBM verification is reachable. On the server side this is reached from
\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP
\nserver accepting PBM-protected messages, and on the client side from CMP
\nresponse validation against a malicious or on-path (MITM) server. The
\nreliable consequence is a denial of service; there is no memory disclosure,
\nno controlled memory write, and no path to code execution. CMP is a
\nspecialized feature that an application must explicitly enable.<\/p>\n
FIPS impact: no
\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules
\nare affected by this CVE.<\/p>\n","protected":false},"excerpt":{"rendered":"
Issue summary: OpenSSL CMP password based protection verification only
\nchecks whether the protectionAlg parameter was not NULL and not its
\nASN.1 type, before treating it as a PBMParameter. A crafted m<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11563","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11563","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11563"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11563"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11563"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}