{"data":{"id":"24bb5e50-e1ef-4f45-8218-f89d0625f74f","title":"GHSA-mpwr-8vm7-h73f: package pkcs12: Authentication bypass in Decode functions","summary":"Several functions in the pkcs12 package can incorrectly accept PKCS#12 files (a format for storing encrypted certificates and keys) that were encoded with the wrong password, because they fail to reject overly-short PBMAC1 keys (a cryptographic authentication code). This means an attacker could trick someone into accepting a malicious PKCS#12 file if that person decodes untrusted files and relies on password protection to verify authenticity.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-mpwr-8vm7-h73f","publishedAt":"2026-08-17T21:56:01.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["other"],"issueType":"vulnerability","affectedPackages":["software.sslmate.com/src/go-pkcs12@>= 0.6.0, < 0.7.2 (fixed: 0.7.2)"],"affectedVendors":[],"affectedVendorsRaw":["Anthropic"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":true,"disclosureDate":"2026-08-17T21:56:01.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity"],"aiComponentTargeted":null,"llmSpecific":false,"classifierConfidence":0.72,"researchCategory":null,"atlasIds":null}}