Issue summary: A CMP client that requests certificate revocation on the basis
\nof a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when
\nprocessing a crafted revocation response. <\/p>\n
Impact summary: The NULL pointer dereference happens on a read which
\nleads to a crash and a Denial of Service for the affected client application.<\/p>\n
CWE: CWE-476: NULL-pointer dereference<\/p>\n
Description: A CMP client revoking a certificate has to tell the server which
\ncertificate to revoke, and may do so by supplying a PKCS#10 CSR instead of the
\ncertificate itself or its issuer name and serial number. This is
\n‘openssl cmp -cmd rr -csr ‘ on the command line, or
\nOSSL_CMP_exec_RR_ses() with the certificate supplied via
\nOSSL_CMP_CTX_set1_p10CSR() through the API.<\/p>\n
A CSR does not contain the issuer name and serial number of the certificate,
\nso the client does not send them. A server may optionally name the
\ncertificate it revoked in its response, and the client then compares that
\nname against what it sent. Having sent neither an issuer name nor a serial
\nnumber, it has nothing to compare against, and a server returning a specially
\ncrafted name causes the client to read from a NULL pointer and crash.<\/p>\n
The revocation response is checked for valid message protection before
\nthe affected code is reached, so an attacker must be a malicious or
\ncompromised CMP server, or a man-in-the-middle in possession of the
\nsecret used for message protection. Clients that identify the certificate
\nto be revoked by a certificate or by issuer and serial number rather
\nthan by a PKCS#10 CSR are not affected.<\/p>\n
FIPS impact: no
\nNo FIPS modules are affected by this issue, as the CMP protocol
\nimplementation is outside the OpenSSL FIPS module boundary.<\/p>\n","protected":false},"excerpt":{"rendered":"
Issue summary: A CMP client that requests certificate revocation on the basis
\nof a PKCS#10 CSR may dereference a NULL pointer and terminate abnormally when
\nprocessing a crafted revocation response. <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-30628","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/30628","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=30628"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=30628"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=30628"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}