OpenSSL CMS AuthEnvelopedData Forged Message Acceptance

OpenSSL CMS processing for AuthEnvelopedData fails to sufficiently validate the cipher selection and authentication tag length fields in CMS containers. In the documented non-AEAD cipher case, OpenSSL accepts an AuthEnvelopedData object whose inner content-encryption algorithm identifier has been rewritten from an AEAD mode such as AES-GCM to a non-AEAD mode such as AES-256-OFB, while leaving recipientInfos intact so the victim still unwraps the genuine CEK. OpenSSL then decrypts using the real CEK under the attacker-selected unauthenticated mode and does not properly enforce MAC validation, allowing CMS_decrypt() to return success on forged content. In a second case, an attacker can reduce the AEAD tag length to a single byte, making brute-force integrity bypass feasible. The issue affects OpenSSL 4.0.0 before 4.0.1, 3.6.0 before 3.6.3, 3.5.0 before 3.5.7, 3.4.0 before 3.4.6, and 3.0.0 before 3.0.21. The FIPS modules are not affected.