Norbert Pocs

**Name of the Vulnerable Software and Affected Versions** OpenSSL (affected versions not specified) **Description** A CMP client that requests certificate revocation using a PKCS#10 CSR may experience a NULL pointer dereference when processing a specially crafted revocation response from a server. This occurs because the client, having sent neither an issuer name nor a serial number, lacks the necessary data to compare against the name returned by the server, leading to a crash and a Denial of Service. The issue is triggered when using the `openssl cmp -cmd rr -csr <file>` command or the `OSSL CMP exec RR ses()` function in conjunction with `OSSL CMP CTX set1 p10CSR()`. Exploitation requires the attacker to be a malicious or compromised CMP server, or a man-in-the-middle with access to the secret used for message protection. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.