A NULL pointer dereference vulnerability in Crypt::OpenSSL::PKCS12 can lead to application crashes when processing malformed PKCS#12 files.

The vulnerability exists in the print_attribute function, which incorrectly sizes the destination buffer when handling zero-length BMPSTRING attributes. An attacker providing a specifically crafted or malformed PKCS#12 file can trigger a NULL pointer dereference, causing the host process to crash.

This vulnerability has a CVSS score of 7.5, reflecting a significant risk to service availability. By forcing an application crash, an attacker can cause a denial of service for systems that rely on this library for cryptographic operations. This could disrupt critical workflows and authentication services dependent on PKCS#12 file processing.

Immediate Action: Upgrade the Crypt::OpenSSL::PKCS12 module to version 1.98 or later.

Proactive Monitoring: Monitor application logs for segmentation faults or unexpected process terminations associated with certificate or PKCS#12 file parsing.

Compensating Controls: Implement strict input validation or sanitization routines for any untrusted PKCS#12 files before they are passed to the library for processing.

Public Exploit Available: No confirmed public exploit available.

While there is no evidence of active exploitation, the potential for service disruption is high. System administrators should verify their Perl environment dependencies and apply the update to version 1.98 to ensure the robustness of their cryptographic processing routines.