From a39a24b0b693b79a0afc6fdb5f2352b078a08ac7 Mon Sep 17 00:00:00 2001 From: Norbert Pocs Date: Mon, 20 Jul 2026 14:10:47 +0200 Subject: [PATCH] CMP unexpected sender DN used as format string in ERR_raise_data() ossl_cmp_msg_check_update() converts an unexpected CMP response sender DN with X509_NAME_oneline() and passes that peer-controlled string directly as the format argument to ERR_raise_data(). Printable percent characters survive the DN conversion, so a sender such as CN=%s%n reaches vsnprintf() as active format syntax without matching varargs. Fixes: CVE-2026-63073 Original patch by: Filipe Casal of Trail of Bits in collaboration with OpenAI Signed-off-by: Norbert Pocs Reviewed-by: Milan Broz Reviewed-by: Igor Ustinov Merge-date: Mon Aug 24 13:02:29 2026 --- crypto/cmp/cmp_vfy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/cmp/cmp_vfy.c b/crypto/cmp/cmp_vfy.c index d6d18d7d3a..f89a65f010 100644 --- a/crypto/cmp/cmp_vfy.c +++ b/crypto/cmp/cmp_vfy.c @@ -730,7 +730,7 @@ int ossl_cmp_msg_check_update(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg, "expected sender", expected_sender)) { str = X509_NAME_oneline(actual_sender, NULL, 0); ERR_raise_data(ERR_LIB_CMP, CMP_R_UNEXPECTED_SENDER, - str != NULL ? str : ""); + "%s", str != NULL ? str : ""); OPENSSL_free(str); return 0; } -- 2.55.0