Executive Summary

This vulnerability occurs when the function X509_VERIFY_PARAM_set1_email is called to validate a crafted email address, such as during S/MIME message validation. An internal helper function used by this call incorrectly handles the length of the local part of the email address, which can lead to an out of bounds read.

Specifically, the 64 octet limit on the local part of the email address may not be enforced properly, causing the function to read beyond the intended memory boundary. This can result in a crash or denial of service when processing a specially crafted From: address in an email message.

Useful 0 Not Useful 0

Impact Analysis

The primary impact of this vulnerability is a potential crash of the application performing the email validation, leading to a denial of service (DoS).

Since the out of bounds read does not directly expose or exfiltrate data to an attacker, the main risk is service interruption rather than data leakage.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability causes an out of bounds read that can lead to a crash and Denial of Service during S/MIME message validation. However, it does not directly result in data exfiltration or compromise of confidentiality or integrity.

Since the vulnerability does not expose or leak sensitive data, it is unlikely to directly impact compliance with data protection regulations such as GDPR or HIPAA, which primarily focus on protecting personal data confidentiality and integrity.

Nevertheless, the potential for Denial of Service could affect availability, which is also a component of these standards. Organizations relying on S/MIME validation might experience service disruptions, which could indirectly affect compliance if availability requirements are not met.

Useful 0 Not Useful 0