GHSA-mpwr-8vm7-h73f: package pkcs12: Authentication bypass in Decode functions
mediumvulnerability
security
Source: GitHub Advisory DatabaseAugust 17, 2026
Summary
Several functions in the pkcs12 package can incorrectly accept PKCS#12 files (a format for storing encrypted certificates and keys) that were encoded with the wrong password, because they fail to reject overly-short PBMAC1 keys (a cryptographic authentication code). This means an attacker could trick someone into accepting a malicious PKCS#12 file if that person decodes untrusted files and relies on password protection to verify authenticity.
Classification
Attack Type
Other
Attack SophisticationModerate
Impact (CIA+S)
integrity
Affected Vendors
Affected Packages
software.sslmate.com/src/go-pkcs12@>= 0.6.0, < 0.7.2 (fixed: 0.7.2)
Related Issues
Monthly digest — independent AI security research
Original source: https://github.com/advisories/GHSA-mpwr-8vm7-h73f
First tracked: August 17, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 72%