Daniel Kubec

An issue exists in the AES-GCM-SIV implementation where a zero-length Additional Authenticated Data (AAD) update is treated as a reset of all previously supplied AAD instead of leaving it unchanged. This causes messages to be produced or verified with authentication tags that do not cover the AAD provided before the empty fragment, allowing an attacker to forge the AAD. Additionally, AAD was not reset during context re-initialisation, meaning AAD from previous context usage was incorrectly included in new messages.

An issue exists in the Certificate Management Protocol (CMP) password-based MAC protection verification. The library uses the `X509 ALGOR get0()` function to read the `protectionAlg` algorithm parameter, which returns a parameter type and a value pointer. The system casts this value to an `ASN1 STRING` and treats it as a `PBMParameter` after verifying only that the pointer is not NULL, failing to consult the actual parameter type. A remote, unauthenticated attacker can send a crafted message containing a parameter of a different type, leading to an invalid pointer dereference. This can result in a Denial of Service (DoS) by crashing applications acting as CMP servers that accept PBM-protected messages, or CMP clients interacting with a malicious or intercepted server. This occurs within the `OSSL CMP SRV process request()` function on the server side and during response validation on the client side. This issue requires the CMP feature to be explicitly enabled.

An 8-byte out-of-bounds heap write occurs during CMS decryption when the key-unwrap output buffer is sized based on the queried unwrapped key size, but the AES-WRAP-PAD unwrap primitive writes more bytes than reported. An attacker can trigger this by supplying a crafted CMS message and modifying a single OID byte to select the padded variant. This leads to heap corruption and typically results in a Denial of Service. The issue is reachable via the `CMS decrypt()` function.

A malicious server can exploit TLS OCSP stapling by delivering a crafted response through the `status request` extension. This triggers a double-free in the client's certificate verification path when the stapled response is checked. A double-free occurs when a program attempts to free the same memory location twice, which can corrupt heap memory. This may lead to a Denial of Service, attacker-controlled code execution, or other undefined behavior. OCSP stapling is not enabled by default.

A NULL pointer dereference occurs when partial-chain certificate verification is enabled alongside OCSP response checking for the entire chain, provided the verified chain lacks a self-signed trusted anchor. This happens because the code attempts to access the next certificate as the issuer, but the issuer remains NULL for the final certificate in the chain under these specific conditions. This can lead to a process crash and a subsequent Denial of Service. The issue specifically affects applications that enable both the `X509 V FLAG OCSP RESP CHECK ALL` and `X509 V FLAG PARTIAL CHAIN` flags, both of which are disabled by default.