AIKIDO-2026-74354
openssl is vulnerable to NULL Pointer Dereference
55
Medium Risk
This Affects:
opensslTL;DR
CMP password based MAC verification reads the protectionAlg parameter and, when the pointer is not NULL, casts it to a PBM parameter without checking the ASN.1 type. A message whose parameter has a different type makes that cast follow an invalid pointer and crashes a CMP server that accepts password based protection, or a CMP client checking a response. The fix checks the parameter type before it uses the value.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application uses CMP with password based message protection.
Background info
openssl is vulnerable to NULL Pointer Dereference in versions 3.0.0 - 3.0.21, 3.4.0 - 3.4.6, 3.5.0 - 3.5.7, 3.6.0 - 3.6.3 and 4.0.0 - 4.0.1.
How to fix this
Upgrade the openssl library to the patch version.
Links
GitHub Release
Fix Commits
github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45bgithub.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570egithub.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.