The vulnerability in Crypt::OpenSSL::PKCS12 (up to version 1.94) arises from improper null termination handling of password parameters. Passwords with embedded NULL bytes are truncated due to the use of strlen() on char * parameters, which discards any bytes after the first NULL. This leads to silent loss of entropy in passwords used for cryptographic operations, such as key derivation and HMAC, potentially weakening the security of the protected data. The issue stems from the interaction between Perl's typemap and C code, where the Perl string length is discarded and strlen() is used instead.

Passwords containing embedded NULL bytes are truncated at the first NULL character, reducing their effective entropy. This silent truncation can weaken cryptographic protections relying on these passwords, such as key derivation functions and HMACs. However, there is no indication of known exploits in the wild. The vulnerability may reduce the strength of password-based protections but does not directly lead to remote code execution or privilege escalation based on the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround has been documented at this time. Users should avoid using passwords with embedded NULL characters as a temporary mitigation until a patch or official guidance is provided.