Commit 958f6f6040 for openssl.org

commit 958f6f6040385a88a322673dbb465f7259ebf0f2
Author: Norbert Pocs <norbertp@openssl.org>
Date:   Mon Jul 20 14:10:47 2026 +0200

    CMP unexpected sender DN used as format string in ERR_raise_data()

    ossl_cmp_msg_check_update() converts an unexpected CMP response sender DN with
    X509_NAME_oneline() and passes that peer-controlled string directly as the
    format argument to ERR_raise_data(). Printable percent characters survive the
    DN conversion, so a sender such as CN=%s%n reaches vsnprintf() as active format
    syntax without matching varargs.

    Fixes: CVE-2026-63073

    Original patch by: Filipe Casal of Trail of Bits in collaboration with OpenAI

    Signed-off-by: Norbert Pocs <norbertp@openssl.org>
    Reviewed-by: Andrew Dinh <andrewd@openssl.org>
    Reviewed-by: Igor Ustinov <igus@openssl.foundation>
    Merge-date: Mon Aug 24 12:53:37 2026

diff --git a/crypto/cmp/cmp_vfy.c b/crypto/cmp/cmp_vfy.c
index c529464dce..53731a12c7 100644
--- a/crypto/cmp/cmp_vfy.c
+++ b/crypto/cmp/cmp_vfy.c
@@ -770,7 +770,7 @@ int ossl_cmp_msg_check_update(OSSL_CMP_CTX *ctx, const OSSL_CMP_MSG *msg,
                 "expected sender", expected_sender)) {
             str = X509_NAME_oneline(actual_sender, NULL, 0);
             ERR_raise_data(ERR_LIB_CMP, CMP_R_UNEXPECTED_SENDER,
-                str != NULL ? str : "<unknown>");
+                "%s", str != NULL ? str : "<unknown>");
             OPENSSL_free(str);
             return 0;
         }