Skip to content

Commit a7e5a6e

Browse files
jogmejogme
committed
CMP unexpected sender DN used as format string in ERR_raise_data()
ossl_cmp_msg_check_update() converts an unexpected CMP response sender DN with X509_NAME_oneline() and passes that peer-controlled string directly as the format argument to ERR_raise_data(). Printable percent characters survive the DN conversion, so a sender such as CN=%s%n reaches vsnprintf() as active format syntax without matching varargs. Fixes: CVE-2026-63073 Original patch by: Filipe Casal of Trail of Bits in collaboration with OpenAI Signed-off-by: Norbert Pocs <[email protected]> Reviewed-by: Milan Broz <[email protected]> Reviewed-by: Igor Ustinov <[email protected]> Merge-date: Mon Aug 24 13:02:29 2026
1 parent 1e8c398 commit a7e5a6e

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

‎crypto/cmp/cmp_vfy.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -730,7 +730,7 @@ int ossl_cmp_msg_check_update(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg,
730730
"expected sender", expected_sender)) {
731731
str = X509_NAME_oneline(actual_sender, NULL, 0);
732732
ERR_raise_data(ERR_LIB_CMP, CMP_R_UNEXPECTED_SENDER,
733-
str != NULL ? str : "<unknown>");
733+
"%s", str != NULL ? str : "<unknown>");
734734
OPENSSL_free(str);
735735
return 0;
736736
}

0 commit comments

Comments
 (0)