Crypt::OpenSSL::PKCS12 versions 1.94 and earlier treat passwords as C strings, trimming any content at the first NULL byte. The library determines length with strlen, so bytes at or after the first NULL are silently discarded. This truncation reduces the entropy of passwords that contain embedded NULLs or binary data, a behavior classified as CWE‑170, weakening the confidentiality of the PKCS12 keystore. It is inferred that a weaker password may allow an attacker to recover private keys or certificates more readily if they can influence or guess the password.

JONASBN Crypt::OpenSSL::PKCS12 for Perl, versions through 1.94. All installations using any of these releases are affected until an upgrade to 1.95 or later is applied.

Any password containing a NULL byte is truncated, a behavior described by CWE‑170, so an attacker could construct a password that causes the keystore to use a much weaker key. This behavior can be exploited locally, as the password is supplied to the library within a process. The CVSS score of 9.8 indicates a critical severity, while the EPSS score of < 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. It is inferred that the attack vector is local or in‑process, and that the reduced entropy could facilitate brute‑force attacks.