CVE-2026-34181

Issue Summary: The PKCS#12 file processing fails to perform sufficient input<br /> validation for files that use Password-Based Message Authentication Code 1<br /> (PBMAC1) integrity mechanism allowing a certificate and private key forgery.<br /> <br /> Impact Summary: An attacker impersonating a user can cause a service reading<br /> PKCS#12 files to accept forged certificates and private keys with a 1 in 256<br /> probability.<br /> <br /> If a service accepting PKCS#12 files is using passwords for authenticating<br /> the received files, the attacker can create unencrypted PKCS#12 files that<br /> use PBMAC1 authentication that specifies an HMAC key of only one byte, allowing<br /> them to craft a file that will be accepted with a 1 in 256 probability.<br /> That would then cause the service to accept a certificate and private key<br /> controlled by the attacker.<br /> <br /> The FIPS modules are not affected by this issue, as the affected code is<br /> outside the OpenSSL FIPS module boundary.