Executive brief
A security issue in a Perl library used for handling PKCS#12 certificates (digital files used for secure communication) causes passwords to be cut off if they contain a specific hidden character (a NULL byte). This means that complex, machine-generated passwords might be significantly shorter and weaker than intended, making it easier for unauthorized parties to guess them or bypass security controls. Organizations using this library to manage encrypted certificates or keys should update to ensure their passwords maintain full strength.
Technical details
The vulnerability exists in the XS (External Subroutine) layer of Crypt::OpenSSL::PKCS12. Password parameters in PKCS12.xs were declared as 'char *', which causes Perl's default typemap to use SvPV_nolen, effectively discarding the explicit string length tracked by Perl. Subsequent calls to strlen() in the C code or within the OpenSSL library itself result in the password being truncated at the first NULL byte. This is particularly impactful for binary, KDF-derived, or HMAC-derived passwords where NULL bytes are common, as it silently reduces the entropy of the secret. Version 1.95 fixes this by using SvPV to preserve the full byte count and adding explicit checks for NULL bytes in APIs that do not support them.
Affected products
- JONASBN Crypt::OpenSSL::PKCS12 through 1.94
Timeline
- 2026-05-17: disclosed
- 2026-05-17: patched: Fixed in version 1.95
- 2026-05-17: advisory