https://bugzilla.redhat.com/show_bug.cgi?id=2512101
Bug ID: 2512101
Summary: CVE-2026-58102 perl-Crypt-OpenSSL-X509:
Crypt::OpenSSL::X509: Information disclosure due to
heap out-of-bounds read. [fedora-all]
Product: Fedora
Version: rawhide
Status: NEW
Whiteboard: {"flaws": ["cd96b651-8c70-4b43-93ea-99e2ed913890"]}
Component: perl-Crypt-OpenSSL-X509
Keywords: Security, SecurityTracking
Severity: high
Priority: high
Assignee: [email protected]
Reporter: [email protected]
QA Contact: [email protected]
CC: [email protected],
[email protected], [email protected]
Blocks: 2499853 (CVE-2026-58102)
Target Milestone: ---
Classification: Fedora
Disclaimer: Community trackers are created by Red Hat Product Security team on
a best effort basis. Package maintainers are required to ascertain if the flaw
indeed affects their package, before starting the update process.
Crypt::OpenSSL::X509 versions before 2.1.3 for Perl allow a heap out-of-bounds
read via a long certificate extension OID in hv_exts.
When building the extension hash (via extensions(), extensions_by_long_name(),
extensions_by_oid(), or has_extension_oid()), the code passes OBJ_obj2txt()'s
return value as the hash-key length; because that value is the OID's full text
length rather than the bytes written to the fixed-size buffer (129 bytes), an
OID whose text is longer than the 129-byte buffer causes a read past the
allocation, exposing adjacent heap memory as the returned hash key.
extensions_by_name() uses the static shortname path and is not affected.
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=2499853
[Bug 2499853] CVE-2026-58102 perl-Crypt-OpenSSL-X509: Crypt::OpenSSL::X509:
Information disclosure due to heap out-of-bounds read.
--
You are receiving this mail because:
You are on the CC list for the bug.
https://bugzilla.redhat.com/show_bug.cgi?id=2512101
Report this comment as SPAM:
https://bugzilla.redhat.com/enter_bug.cgi?product=Bugzilla&format=report-spam&short_desc=Report%20of%20Bug%202512101%23c0
--
_______________________________________________
perl-devel mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedoraproject.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
