{"id":5220,"date":"2026-09-04T18:47:40","date_gmt":"2026-09-04T10:47:40","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-17510"},"modified":"2026-09-04T18:47:40","modified_gmt":"2026-09-04T10:47:40","slug":"cve-2026-17510","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-17510","title":{"rendered":"CVE-2026-17510 [HIGH] &#8211; Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in p"},"content":{"rendered":"<p>Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute.<\/p>\n<p>print_attribute() sizes the destination buffer for a BMPSTRING attribute from its declared byte length with `Renew(*attribute, length, char)`. A zero length attribute makes that a zero size reallocation, which Perl implements as a free returning NULL, so the buffer pointer becomes NULL, the following `strncpy` copies nothing, and the caller dereferences NULL in the `strlen()` it passes to `newSVpvn()`. A zero length BMPSTRING is even length, so the ASN.1 decoder accepts it and the value reaches this code. The UTF8STRING, OCTET STRING and BIT STRING arms size on `length + 1` or `length * 4 + 1` and are unaffected.<\/p>\n<p>Any caller that passes an untrusted PKCS#12 file to info_as_hash() can crash the process. info() prints attribute values directly without sizing a buffer and is unaffected.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Crypt::OpenSSL::PKCS12 versions before 1.98 for Perl allow a NULL pointer dereference in print_attribute via a zero length BMPSTRING attribute.<\/p>\n<p>print_attribute() sizes the destination buffer for a BM<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5220","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}