{"id":16156,"date":"2026-09-04T19:05:10","date_gmt":"2026-09-04T11:05:10","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-34181"},"modified":"2026-09-04T19:05:10","modified_gmt":"2026-09-04T11:05:10","slug":"cve-2026-34181","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-34181","title":{"rendered":"CVE-2026-34181 [HIGH] &#8211; Issue Summary: The PKCS#12 file processing fails to perform sufficient input\nvalidation fo"},"content":{"rendered":"<p>Issue Summary: The PKCS#12 file processing fails to perform sufficient input<br \/>\nvalidation for files that use Password-Based Message Authentication Code 1<br \/>\n(PBMAC1) integrity mechanism allowing a certificate and private key forgery.<\/p>\n<p>Impact Summary: An attacker impersonating a user can cause a service reading<br \/>\nPKCS#12 files to accept forged certificates and private keys with a 1 in 256<br \/>\nprobability.<\/p>\n<p>If a service accepting PKCS#12 files is using passwords for authenticating<br \/>\nthe received files, the attacker can create unencrypted PKCS#12 files that<br \/>\nuse PBMAC1 authentication that specifies an HMAC key of only one byte, allowing<br \/>\nthem to craft a file that will be accepted with a 1 in 256 probability.<br \/>\nThat would then cause the service to accept a certificate and private key<br \/>\ncontrolled by the attacker.<\/p>\n<p>The FIPS modules are not affected by this issue, as the affected code is<br \/>\noutside the OpenSSL FIPS module boundary.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Issue Summary: The PKCS#12 file processing fails to perform sufficient input<br \/>\nvalidation for files that use Password-Based Message Authentication Code 1<br \/>\n(PBMAC1) integrity mechanism allowing a certific<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-16156","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/16156","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16156"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16156"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16156"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}