CVE-2026-42769

Issue Summary: An error in the callback used to verify the certificate<br /> provided in a Root CA key update Certificate Management Protocol (CMP)<br /> message response rendered the certificate validation ineffectual, which<br /> could lead to escalation of credentials from the Registration Authority (RA)<br /> level to the root Certification Authority (root CA) level.<br /> <br /> Impact Summary: The Registration Autority could replace the root CA<br /> certificate for the CMP clients with an arbitrary root CA certificate.<br /> <br /> One of the parts of the Certificate Management Protocol (CMP), specified in<br /> RFC 9810, is Root Certification Authority (root CA) key Rollover,<br /> which is sent by the server in a message with type &amp;#39;id-it-rootCaKeyUpdate&amp;#39;.<br /> As part of these messages, &amp;#39;newWithOld&amp;#39; certificate, the new root CA<br /> certificate signed with the old root CA key, is provided, and verifying its<br /> signature is crucial for transferring the trust from the old CA key to the<br /> new one.<br /> <br /> The &amp;#39;id-it-rootCaKeyUpdate&amp;#39; messages are expected to be processed with<br /> OSSL_CMP_get1_rootCaKeyUpdate(), that is expected to verify the &amp;#39;newWithOld&amp;#39;<br /> certificate. A typo in the certificate chain building code led to adding<br /> an incorrect certificate (&amp;#39;newWithOld&amp;#39; instead of &amp;#39;oldRoot&amp;#39;) to the<br /> certificate chain, rendering the certificate verification process ineffectual<br /> (only the issuer name and the algorithm OIDs were verified by other parts<br /> of the verification code).<br /> <br /> An attacker who already has credentials that satisfy the CMP message<br /> protection checks can generate a new key pair and use a crafted self-signed<br /> certificate in its &amp;#39;id-it-rootCaKeyUpdate&amp;#39; CMP messages which affected CMP<br /> clients would accept as a new trust anchor.<br /> <br /> Significant preconditions for the attack (having valid RA-level credentials)<br /> are the reason the issue was assigned Low severity.<br /> <br /> The FIPS modules are not affected by this issue, as the affected code is<br /> outside the OpenSSL FIPS module boundary.