> CVE-2026-34181

« BACK_TO_HOME
PUBLISHED
2026-06-09 17:17
MODIFIED
2026-06-09 17:17
EPSS (Prob. Exploit)
0.38%
Top 68.3%
DATA SOURCES:
NVD 🔗 2026-06-09 RED HAT 🔗 2026-06-14 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-01 OSV 🔗 2026-11-02 MSRC 🔗 2026-11-02

> DESCRIPTION

Issue Summary: The PKCS#12 file processing fails to perform sufficient input validation for files that use Password-Based Message Authentication Code 1 (PBMAC1) integrity mechanism allowing a certificate and private key forgery. Impact Summary: An attacker impersonating a user can cause a service reading PKCS#12 files to accept forged certificates and private keys with a 1 in 256 probability. If a service accepting PKCS#12 files is using passwords for authenticating the received files, the attacker can create unencrypted PKCS#12 files that use PBMAC1 authentication that specifies an HMAC key of only one byte, allowing them to craft a file that will be accepted with a 1 in 256 probability. That would then cause the service to accept a certificate and private key controlled by the attacker. The FIPS modules are not affected by this issue, as the affected code is outside the OpenSSL FIPS module boundary.

> AFFECTED_PRODUCTS

Red Hat - Red Hat Enterprise Linux 10
Version: 3.5.5
Red Hat - Red Hat Enterprise Linux 9
Version: 3.5.5

> WEAKNESSES

CWE-354

> CWE DETAILED DESCRIPTIONS

CWE-354: Improper Validation of Integrity Check Value - The product does not validate or incorrectly validates the integrity check values or "checksums" of a message.

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (...
Red Hat Security Advisory: openssl security update
An update for openssl is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System...
Red Hat Security Advisory: Red Hat Update Infrastructure 5.2 security update
The latest release of Red Hat Update Infrastructure. For more details, see the product documentation.
Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage
A Subscription Management tool for finding and reporting Red Hat product usage
Red Hat Security Advisory: Insights proxy Container Image
Initial GA Release of Red Hat Insights proxy
Red Hat Security Advisory: Red Hat Update Infrastructure 5.3 Technology Preview security update
A new set of Red Hat Update Infrastructure container images is now available as a Technology Preview in the Red Hat container registry.
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.20.1
cert-manager Operator for Red Hat OpenShift 1.20.1
Red Hat Security Advisory: Red Hat JBoss Web Server 6.2.5 release and security update
Red Hat JBoss Web Server 6.2.5 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has r...
Red Hat Security Advisory: Red Hat JBoss Web Server 7.0.2 release and security update
Red Hat JBoss Web Server 7.0.2 zip release is now available for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Windows Server. Red Hat Product Security has r...
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2
cert-manager Operator for Red Hat OpenShift 1.18.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2
cert-manager Operator for Red Hat OpenShift 1.18.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.18.2
cert-manager Operator for Red Hat OpenShift 1.18.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.2
cert-manager Operator for Red Hat OpenShift 1.17.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.2
cert-manager Operator for Red Hat OpenShift 1.17.2
Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.2
cert-manager Operator for Red Hat OpenShift 1.17.2

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Low

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys

AFFECTED PACKAGES:
Unknown / Unknown
24 versions affected

> HISTORIQUE DES MODIFICATIONS

Première apparition
09/06/2026 17:17
Source: NVD
📊 ENRICHISSEMENT 01/11/2026 06:59
CWE
Champ modifié: Description CWE
Ancienne valeur:
CWE-354: Improper Validation of Integrity Check Value - The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detectin...
Nouvelle valeur:
CWE-354: Improper Validation of Integrity Check Value - The product does not validate or incorrectly validates the integrity check values or "checksums" of a message.
📊 ENRICHISSEMENT 01/07/2026 06:01
CWE
Champ modifié: Description CWE
Ancienne valeur:
N/A
Nouvelle valeur:
CWE-354: Improper Validation of Integrity Check Value - The product does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detectin...
📊 ENRICHISSEMENT 14/06/2026 05:00
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Low", "severity_scale": null }
📊 ENRICHISSEMENT 14/06/2026 05:00
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 4 Dernière mise à jour: 6 days ago

> REFERENCES

https://github.com/openssl/security/commit/0300eb9ddce7a0895bf301a4b0c03a9da2313...
https://github.com/openssl/security/commit/79eb76a937e474bb7610a0a3dc57131dc8dc6...
https://github.com/openssl/security/commit/85dcbb3abaa4878af5c8fbbe11bce708fcf98...
https://github.com/openssl/security/commit/ec36f2417c4ddd8cabce4b4a60a3d7a7365f2...
https://openssl-library.org/news/secadv/20260609.txt
« BACK_TO_HOME