Executive brief
OpenSSL is a widely used security library that helps protect data and verify identities online. A flaw in how it processes certain digital certificate files (PKCS#12) could allow an attacker to trick a system into accepting a forged certificate or private key. While the attack has a low mathematical probability of success (1 in 256), if successful, it could allow an attacker to impersonate a legitimate user or gain unauthorized access to secured services.
Technical details
A vulnerability exists in OpenSSL's PKCS#12 implementation due to improper validation of integrity check values (CWE-354). When processing PKCS#12 files using the Password-Based Message Authentication Code 1 (PBMAC1) mechanism, an attacker can craft an unencrypted file that specifies an HMAC key length of only one byte. This significantly reduces the entropy of the integrity check, allowing a forged certificate and private key to be accepted with a 1 in 256 probability. This issue affects OpenSSL versions 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, and 1.0.2, though FIPS modules are unaffected as the vulnerable code resides outside the FIPS boundary.
Affected products
- OpenSSL Foundation OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, 1.0.2
Timeline
- 2026-06-09: disclosed: Vulnerability published in OpenSSL security advisory.
References
- https://github.com/openssl/security/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313a0f
- https://github.com/openssl/security/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6610
- https://github.com/openssl/security/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf984a7
- https://github.com/openssl/security/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2d81
- https://openssl-library.org/news/secadv/20260609.txt