CVE-2026-63073

*** Pendiente de traducción *** Issue summary: OpenSSL CMP response validation passed an unexpected response<br /> sender distinguished name directly as the format string to `ERR_raise_data()`.<br /> <br /> Impact summary: A malicious or intercepted CMP endpoint can crash a CMP client<br /> that enforces an expected sender or uses a pinned server certificate whose<br /> subject becomes the default expected sender.<br /> <br /> CWE: CWE-134 (Use of Externally-Controlled Format String)<br /> <br /> Description: When validating a received CMP message, ossl_cmp_msg_check_update()<br /> converts the peer-supplied sender distinguished name with X509_NAME_oneline()<br /> and passes it directly as the format argument to ERR_raise_data(). Percent<br /> characters survive the conversion, so a sender DN such as "CN=%s%n" reaches<br /> BIO_vsnprintf() as an attacker-controlled format string with no matching variadic<br /> arguments. This path is only reached when the caller configures an expected<br /> sender or pins a server certificate, which is the normal configuration for a<br /> CMP client validating server responses.<br /> <br /> Since the attacker controls the format string but none of the variadic<br /> arguments, such specifiers as %s and %n dereference or write through unrelated<br /> stack contents and crash the client. The reliable consequence is a denial of<br /> service, when the response comes from a malicious or intercepted CMP endpoint.<br /> There is no controlled memory write, arbitrary-address read, or reliable path<br /> to remote code execution.<br /> <br /> FIPS impact: no<br /> <br /> No FIPS modules are affected by this issue, as the CMP protocol<br /> implementation is outside the OpenSSL FIPS module boundary.