You are viewing this page in an unauthorized frame window.
This is a potential security issue, you are being redirected to
https://nvd.nist.gov
An official website of the United States government
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)
processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK
cipher can trigger a heap out-of-bounds read in kek_unwrap_key().
Impact summary: A heap buffer over-read may trigger a crash which leads to
Denial of Service for an application if the input buffer ends at a memory
page boundary and the following page is unmapped. There is no information
disclosure as the over-read bytes are not revealed to the attacker.
The key unwrapping function performs a check-byte test as specified in the
RFC that reads 7 bytes from a heap allocation that is based on the wrapped
key length from the message. There is a minimum length check based on the
block length of the wrapping cipher. However the cipher is selected from
an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no
requirement that the cipher be a block cipher. When an attacker selects
a stream-mode cipher the guard will be ineffective and the allocated buffer
containing the unwrapped key can be too small to fit the check-bytes
specified in the RFC and a buffer over-read can happen.
Applications calling CMS_decrypt() or CMS_decrypt_set1_password()
(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS
data are vulnerable to this issue. No password knowledge is required: the
over-read happens during the unwrap attempt before any authentication
succeeds.
The over-read is limited to a few bytes and is not written to output, so
there is no information disclosure. Triggering a crash requires the
allocation to border unmapped memory, which is unlikely with the normal
allocator.
The FIPS modules are not affected by this issue.
Metrics
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected].
Title: OpenSSL, Description: Resumen del problema: Cuando el descifrado basado en contraseña de CMS (RFC 3211 / desenvolvimiento de clave PWRI) procesa datos CMS suministrados por el atacante, un cifrado KEK en modo de flujo elegido por el atacante puede desencadenar una lectura fuera de límites en el heap en kek_unwrap_key().
Resumen del impacto: Una lectura excesiva del búfer del heap puede desencadenar un fallo que lleva a la denegación de servicio para una aplicación si el búfer de entrada termina en un límite de página de memoria y la página siguiente no está mapeada. No hay revelación de información ya que los bytes leídos en exceso no se revelan al atacante.
La función de desenvolvimiento de clave realiza una prueba de bytes de verificación según lo especificado en el RFC que lee 7 bytes de una asignación en el heap que se basa en la longitud de la clave envuelta del mensaje. Hay una verificación de longitud mínima basada en la longitud de bloque del cifrado de envoltura. Sin embargo, el cifrado se selecciona de un OID transportado en el algoritmo de cifrado de clave PWRI del atacante sin el requisito de que el cifrado sea un cifrado de bloque. Cuando un atacante selecciona un cifrado en modo de flujo, la protección será ineficaz y el búfer asignado que contiene la clave desenvuelta puede ser demasiado pequeño para contener los bytes de verificación especificados en el RFC y puede ocurrir una lectura excesiva del búfer.
Las aplicaciones que llaman a 'CMS_decrypt()' o 'CMS_decrypt_set1_password()' (equivalentemente OpenSSL cms -decrypt -pwri_password ...) en datos CMS no confiables son vulnerables a este problema. No se requiere conocimiento de la contraseña: la lectura excesiva ocurre durante el intento de desenvolvimiento antes de que cualquier autenticación tenga éxito.
La lectura excesiva está limitada a unos pocos bytes y no se escribe en la salida, por lo que no hay revelación de información. Desencadenar un fallo requiere que la asignación limite con memoria no mapeada, lo cual es poco probable c
OR
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.0.2 up to (excluding) 1.0.2zq
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 1.1.1 up to (excluding) 1.1.1zh
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.0.0 up to (excluding) 3.0.21
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.4.0 up to (excluding) 3.4.6
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.5.0 up to (excluding) 3.5.7
*cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* versions from (including) 3.6.0 up to (excluding) 3.6.3
*cpe:2.3:a:openssl:openssl:4.0.0:-:*:*:*:*:*:*
New CVE Received from OpenSSL Software Foundation6/09/2026 1:17:50 PM
Action
Type
Old Value
New Value
Added
Description
Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)
processes attacker-supplied CMS data, an attacker-chosen stream-mode KEK
cipher can trigger a heap out-of-bounds read in kek_unwrap_key().
Impact summary: A heap buffer over-read may trigger a crash which leads to
Denial of Service for an application if the input buffer ends at a memory
page boundary and the following page is unmapped. There is no information
disclosure as the over-read bytes are not revealed to the attacker.
The key unwrapping function performs a check-byte test as specified in the
RFC that reads 7 bytes from a heap allocation that is based on the wrapped
key length from the message. There is a minimum length check based on the
block length of the wrapping cipher. However the cipher is selected from
an OID carried in the attacker's PWRI keyEncryptionAlgorithm with no
requirement that the cipher be a block cipher. When an attacker selects
a stream-mode cipher the guard will be ineffective and the allocated buffer
containing the unwrapped key can be too small to fit the check-bytes
specified in the RFC and a buffer over-read can happen.
Applications calling CMS_decrypt() or CMS_decrypt_set1_password()
(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS
data are vulnerable to this issue. No password knowledge is required: the
over-read happens during the unwrap attempt before any authentication
succeeds.
The over-read is limited to a few bytes and is not written to output, so
there is no information disclosure. Triggering a crash requires the
allocation to border unmapped memory, which is unlikely with the normal
allocator.
The FIPS modules are not affected by this issue.
) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
