Ying Dong

An issue exists in the Certificate Management Protocol (CMP) password-based MAC protection verification. The library uses the `X509 ALGOR get0()` function to read the `protectionAlg` algorithm parameter, which returns a parameter type and a value pointer. The system casts this value to an `ASN1 STRING` and treats it as a `PBMParameter` after verifying only that the pointer is not NULL, failing to consult the actual parameter type. A remote, unauthenticated attacker can send a crafted message containing a parameter of a different type, leading to an invalid pointer dereference. This can result in a Denial of Service (DoS) by crashing applications acting as CMP servers that accept PBM-protected messages, or CMP clients interacting with a malicious or intercepted server. This occurs within the `OSSL CMP SRV process request()` function on the server side and during response validation on the client side. This issue requires the CMP feature to be explicitly enabled.

Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers. This allows attackers to achieve key-equivalent functionality for a CMS recipient or bypass integrity validation for a message. In one scenario, an attacker can send a CMS message where the cipher is specified as a non-AEAD (Authenticated Encryption with Associated Data) cipher. If an attacker captures a legitimate AES-GCM AuthEnvelopedData message, they can rewrite the inner OID to AES-256-OFB (an unauthenticated keystream mode) with a chosen IV and ciphertext. If the application provides feedback on the success or failure of the decryption, it can act as an oracle to obtain key-equivalent functionality for the `CEK` (content-encryption key). Additionally, an attacker can reduce the tag length of an AEAD cipher to a single byte, enabling a brute-force attack to bypass integrity checks in applications relying on the `CMS decrypt()` function to reject modified content.