Log in Start free

Vulnerability · Published Jan 26, 2024 · Assigned by openssl

CVE-2024-0727PKCS12 Decoding crashes

Medium 5.5

In plain English

A medium-severity null pointer dereference in OpenSSL from OpenSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)3.2%top 11.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9edk2-aarch6420240524-6.el9_5ALSA-2024:9088
AlmaLinux:9edk2-ovmf20240524-6.el9_5ALSA-2024:9088
AlmaLinux:9edk2-tools20240524-6.el9_5ALSA-2024:9088
AlmaLinux:9edk2-tools-doc20240524-6.el9_5ALSA-2024:9088
AlmaLinux:9openssl1:3.0.7-27.el9ALSA-2024:2447
AlmaLinux:9openssl-devel1:3.0.7-27.el9ALSA-2024:2447
AlmaLinux:9openssl-libs1:3.0.7-27.el9ALSA-2024:2447
AlmaLinux:9openssl-perl1:3.0.7-27.el9ALSA-2024:2447
Alpine:v3.20openssl3.1.4-r5ALPINE-CVE-2024-0727
Alpine:v3.21openssl3.1.4-r5ALPINE-CVE-2024-0727
Alpine:v3.22openssl3.1.4-r5ALPINE-CVE-2024-0727
Alpine:v3.23openssl3.1.4-r5ALPINE-CVE-2024-0727
Alpine:v3.24openssl3.1.4-r5ALPINE-CVE-2024-0727
Debian:12openssl3.0.13-1~deb12u1DEBIAN-CVE-2024-0727
Debian:13openssl3.1.5-1DEBIAN-CVE-2024-0727
Debian:14openssl3.1.5-1DEBIAN-CVE-2024-0727
PyPIcryptography42.0.2GHSA-9v9h-cgj8-h64p
PyPIcryptography42.0.2PYSEC-2026-1285
Rocky Linux:9edk20:20240524-6.el9_5.3RLSA-2024:9088
Ubuntu:22.04:LTSedk22022.02-3ubuntu0.22.04.4USN-7894-1
Ubuntu:22.04:LTSedk22022.02-3ubuntu0.22.04.4UBUNTU-CVE-2024-0727
Ubuntu:24.04:LTSedk22024.02-2ubuntu0.6USN-7894-1
Ubuntu:24.04:LTSedk22024.02-2ubuntu0.6UBUNTU-CVE-2024-0727
Ubuntu:22.04:LTSopenssl3.0.2-0ubuntu1.14UBUNTU-CVE-2024-0727
Ubuntu:22.04:LTSopenssl3.0.2-0ubuntu1.14USN-6622-1
Ubuntu:24.04:LTSopenssl3.0.10-1ubuntu4UBUNTU-CVE-2024-0727

Affected products (as reported)

VendorProductVersions
OpenSSL OpenSSL 3.2.0 – before 3.2.13.1.0 – before 3.1.53.0.0 – before 3.0.131.1.1 – before 1.1.1x1.0.2 – before 1.0.2zj

Weakness: CWE-476 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References