# Revision history for Perl extension Crypt::OpenSSL::PKCS12.

# 1.99 2026-08-16, OpenSSL 4.0 compatibility, update recommended

- Promoted from the 1.99-TRIAL release of 2026-08-09 with no code changes. CPAN Testers coverage came back clean, including
  real OpenSSL 4.0 builds; the only failure observed was on OpenBSD with Perl 5.45.2, a platform/Perl combination this
  distribution does not target (minimum supported Perl is 5.14, per `RuntimeRequires` in `dist.ini`).

- Fix [#57](https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/57) and
  [#60](https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/60): OpenSSL 4.0 made `ASN1_STRING` (the type backing
  `ASN1_BMPSTRING`, `ASN1_UTF8STRING`, `ASN1_OCTET_STRING`, and `ASN1_BIT_STRING`) opaque, breaking direct `->data`/`->length`
  struct access throughout `print_attribute()`. Replaced with the `ASN1_STRING_get0_data()`/`ASN1_STRING_length()` accessor API,
  which also works unchanged on OpenSSL 1.x/3.x. Verified against a real OpenSSL 4.0.1 build: compiles, links, and passes the
  full test suite, where the previous code failed to compile with "incomplete definition of type" errors. Merged via PR
  [#61](https://github.com/dsully/perl-crypt-openssl-pkcs12/pull/61).

- Fix [#62](https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/62) (partial): `changepass()`'s underlying
  `PKCS12_newpass()` is fundamentally broken upstream for PBES2-encrypted PKCS12 files, the default on OpenSSL 3.x/4.x,
  confirmed via [openssl/openssl#19092](https://github.com/openssl/openssl/issues/19092) and not fixable from this
  module without a much larger reimplementation. `changepass()` no longer crashes the whole process on OpenSSL 3.x/4.x (a
  follow-on `mac_ok()` croak was previously left unguarded after a failed `changepass()`), and the test suite's skip guard now
  correctly covers every OpenSSL major except the confirmed-working 1.x, instead of only 3.x. Documented the limitation in POD
  and `CLAUDE.md`. Merged via PR [#76](https://github.com/dsully/perl-crypt-openssl-pkcs12/pull/76) and
  [#77](https://github.com/dsully/perl-crypt-openssl-pkcs12/pull/77).

# 1.98 2026-08-08, security release, update recommended

- Security: fix NULL pointer dereference in `print_attribute()`'s `V_ASN1_BMPSTRING` branch. An empty (zero-length) BMPSTRING bag
  attribute caused `Renew(*attribute, 0, char)` to free the buffer and leave `*attribute` NULL (Perl's `safesysrealloc` treats a
  zero size as free-and-return-NULL); downstream callers then dereferenced NULL inside `strlen()`, causing a deterministic crash.
  Reachable from a crafted PKCS12 via `info_as_hash()`. Fixed by sizing the buffer on `strlen(value) + 1` instead of the raw ASN.1
  length, and adding a NULL check on `OPENSSL_uni2asc()`'s return. Reported and fixed by Timothy Legge.

- Fix: `ssl_error()` returned an uninitialized/undef value (triggering a "Use of uninitialized value" warning) when the OpenSSL
  error stack was empty, e.g. on a MAC verification failure with no underlying library error. Now returns an empty string in
  that case. Fixed by Timothy Legge.

# 1.97 2026-06-24, update recommended

- Fix [#63](https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/63): `get_hex()` did not NUL-terminate its output; zero-length
  OCTET STRING or BIT STRING attributes left the buffer entirely uninitialised, causing undefined behaviour on any downstream
  `strlen()` or pointer access. Fixed by writing `'\0'` after the loop and increasing the `Renew` allocation from `length*4` to
  `length*4+1` at both call sites. Merged via PR [#65](https://github.com/dsully/perl-crypt-openssl-pkcs12/pull/65).

- Fix: `CertBag.certValue` encoding — certificate DER bytes are now correctly wrapped in an OCTET STRING as required by RFC 7292.

- Test: add regression test `t/pkcs12-info-zero-length-attributes.t` covering zero-length OCTET STRING and BIT STRING bag attributes.

- Build: add `Convert::ASN1` as a `develop` dependency (used by the fixture generation script `scripts/generate-zero-length-attr-fixture.pl`).

# 1.96 2026-06-19, security release, update recommended

- Security: fix [CVE-2026-9265](https://www.cve.org/CVERecord?id=CVE-2026-9265) — heap out-of-bounds read in `print_attribute`
  UTF8STRING path. Reported and fixed by @timlegge via PR [#59](https://github.com/dsully/perl-crypt-openssl-pkcs12/pull/59).

- Fix [#55](https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/55): missing length guard in BMPSTRING branch of `print_attribute`.

- Fix [#56](https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/56): buffer too small for attribute types with names longer than 4 characters;
  switched `strncpy` to `memcpy` in the UTF8STRING path.

- Fix potential memory leak on a croak in `print_attribute`.

- Fix broken builds caused by version mismatch in extra `Makefile.PL`.

# 1.95 2026-05-17, security release, update recommended

- Security: fix [CVE-2026-8507](https://www.cve.org/CVERecord?id=CVE-2026-8507) — integer overflow in `print_attribute` leading to
  heap out-of-bounds write when an OCTET STRING or BIT STRING attribute length
  overflows `int * 4`. Lengths > `INT_MAX/4` now croak explicitly.

- Security ([CVE-2026-8721](https://www.cve.org/CVERecord?id=CVE-2026-8721)): length-aware password handling across all XS entry points.
  Passwords are now extracted with `SvPV` (preserving the full Perl string length)
  rather than relying on `strlen`. APIs that accept an explicit length
  (`PKCS12_verify_mac`, `dump_certs_keys_p12`) receive the true byte count;
  APIs that use `strlen` internally (`PKCS12_create`, `PKCS12_newpass`) now
  croak with a clear diagnostic if the password contains an embedded NUL byte.

  Thanks to the [CPANsec team](https://security.metacpan.org) for reporting and assisting with these issues.

# 1.94 2024-10-01

- Merge of PR: [#52](https://github.com/dsully/perl-crypt-openssl-pkcs12/pull/52) from @dakkar, first time contributor to the distribution, thanks for the contribution
  This PR introduces a new feature, which allows for the extraction a certificate chain from a PKCS12 file via a new method `ca- certificate`

# 1.93 2024-09-28

- Inclusion of PR: [#51](https://github.com/dsully/perl-crypt-openssl-pkcs12/pull/51) aimed at addressing the following issues observed with previous release: `1.92`, thanks to @timlegge for the contribution
  - [#48](https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/48)
  - [#49](https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/49)
  - [#40](https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/50)

# 1.92 2024-09-08

Addition of new feature supporting the OpenSSL info option, all via PR [#44](https://github.com/dsully/perl-crypt-openssl-pkcs12/pull/44) from @timlegge

## 1.91 Mon Jun 24 22:00:13 CEST 2024

Due to a mistake with the release numbering, the two trial releases, should not have been `1.10` and `1.11`, but `1.91` and `1.92` respectively. So there will be a jump from 1.9 to 1.91, since 1.9 is equivalent to 1.90.

This release contains changes tested on the two previous trial releases.

In addition the following changes have been adopted:

- PR: [#47](https://github.com/dsully/perl-crypt-openssl-pkcs12/pull/47) from @timlegge, improving support for building with OpenSSL located in non-standard locations

## 1.11 (TRIAL) Wed Jun  5 20:21:54 CEST 2024

- Improved support for older versions of OpenSSL via PR [#46](https://github.com/dsully/perl-crypt-openssl-pkcs12/pull/46) from @timlegge
  This should address reports on failing tests from CPAN testers, see also: [#45](https://github.com/dsully/perl-crypt-openssl-pkcs12/issues/45)

- Minor cleanup to repository files used for varies tools

## 1.10 (TRIAL) Fri Apr 26 16:09:56 CEST 2024

- Improved support for OpenSSL 3.0 via RT: [42](https://github.com/dsully/perl-crypt-openssl-pkcs12/pull/42) from @timlegge

- Distribution tooling changed from `Module::Install` to `Dist::Zilla`

## 1.9 Sat Nov 20 12:49:34 CET 2021

- Added new feature from `create_as_string` via PR #39 from James Rouzier (@jrouzierinverse), which returns the PKCS data as a string, for futher handling

- Bumped Perl requirement from Perl 5.6 to 5.8, due to use of UTF-8 in test suite

- POD cleaned up, more to come

## 1.8 Fri Nov 12 20:31:24 CET 2021

- Applied patch via PR #37 from @SmartCodeMaker, calculating of strings and handling Windows files properly

- Applied patch via PR #38 from @SmartCodeMaker, formatting print of SVs displays garbage as documented in the perlguts documentation

  REF: https://perldoc.perl.org/perlguts#Formatted-Printing-of-SVs

## 1.7  Fri May 21 21:16:53 CEST 2021

- Removed some unnecessary code from a test, the code would not compile on Perl 5.18

## 1.6  Thu May 20 07:32:35 CEST 2021

- Added encoding declaration to POD section, I had overlooked a special character in one of the names of the contributors

## 1.5  Wed May 19 22:03:48 CEST 2021

- Addressed minor issue with the implementation added in 1.4, fix lifted from Crypt::OpenSSL::X509 - Thanks Shoichi Kaji

- Added section on contributors to the POD

## 1.4  Sun Apr 11 16:23:54 CEST 2021

- Addressed issue with homebrew path reported for Crypt::OpenSSL::X509

  REF: https://github.com/dsully/perl-crypt-openssl-x509/issues/81

  The pattern is the same in this distribution

## 1.3  Thu Jun  4 21:39:30 CEST 2020

- Maintenance release addressing the broken inc/ configuration pointed out in: RT:77784 by HMBRAND

  REF: https://rt.cpan.org/Ticket/Display.html?id=77784

## 1.2  Sat Oct 27 09:37:04 CEST 2018

- Maintenance release addressing the missing exclusion of the MYMETA files issue spotted by Alexandr Ciornii (@chorny) #issue32

## 1.1  Fri Oct 26 07:54:48 CEST 2018

- PR from Todd Rinaldo (@toddr) Adding use of our instead of vars, since we are now bumping Perl version requirement
  from 5.005 to 5.6.0

- PR from Todd Rinaldo (@toddr) Exchange DynaLoader for XSLoader, bumping Perl version requirement
  from 5.005 to 5.6.0

- PR from Todd Rinaldo (@toddr) Add Makefile.PL support for perl 5.26.0 and above which don't include . in @INC

## 1.0  Mon Mar 19 21:20:49 CET 2018

- Re-release of 0.10, due to indexing issue with PAUSE/CPAN ref: #28

## 0.10  Wed Mar 14 08:11:54 CET 2018

- Patch from kelson (@kelson42) improving the code, going from two pass to one pass, speeding up the chain management PR #27

## 0.9   Sun Mar 11 19:45:18 CET 2018

- Patch from kelson (@kelson42) addressing compilation issues against OpenSSL 1.1.0 PR #24

## 0.8   Sun Nov 20 19:21:47 CET 2017

- Patch from jonasbn improving handling of C include paths

- Patch from jonasbn reinitializing inc/ and Module::Install integration

- Patch from Songmu adjusting use of paths and flags in Makefile.PL

- Patch from jonasbn adding inc/Module/Install/External.pm from Module::Install missing from MANIFEST

- Patch from jonasbn for compatibility with required C libraries installed via Homebrew on OSX

- Patch from jonasbn to address clang changes

- Patch from Christopher Hoskin enabling compatibility with OpenSSL 1.1.0 and backwards compatibility with OpenSSL 1.0.2

## 0.7   Fri Oct 24 06:16:43 PDT 2014

- Patch from Mikołaj Zalewski to fix C90 issue on CentOS.

- Patch from Darko Prelec to fix compile issue #2.

## 0.6   Thu May 10 10:44:30 PDT 2012

- Patch from Leonid Antonenkov to implement private key access.

- Misc compile fixes.

## 0.5   Sun May 18 08:19:14 PDT 2008

- Fix pod coverage tests.

## 0.4   Sat May 17 00:47:36 PDT 2008

- Stop cpansmoke from emailing me.

## 0.3   Fri Jan  5 15:36:28 PST 2007

- Add more POD & coverage.
- Fix META.yml

## 0.2   Thu Jan  4 10:21:31 PST 2007

- Use Module::Install

- Added tests.

- PKCS12 Create from JoNO

## 0.1   Thu Jan 29 17:01:38 PST 2004

- Initial release.
