Read the docs
TI-2024-00667 Aliases CVE-2024-0727GHSA-9v9h-cgj8-h64p

PKCS12 Decoding crashes

Priority LOW 31CWE-476Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 4 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-476.

Summary

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03187 88th percentileScored 2026-11-07
Fix Partial OpenSSL (OpenSSL): 3.2.1, 3.1.5, 3.0.13 +2cryptography (PyPI): 42.0.2Red Hat: 2 advisoriesRed Hat: 3 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
OpenSSLOpenSSL3.2.0 to before 3.2.1; 3.1.0 to before 3.1.5; 3.0.0 to before 3.0.13; 1.1.1 to before 1.1.1x; 1.0.2 to before 1.0.2zj3.2.1, 3.1.5, 3.0.13, 1.1.1x, 1.0.2zjPatch availableCNA
—cryptography (PyPI)before 42.0.242.0.2Patch availableGHSA-9v9h-cgj8-h64p
  • OpenSSL VendorOpenSSL Affected 3.2.0 to before 3.2.1; 3.1.0 to before 3.1.5; 3.0.0 to before 3.0.13; 1.1.1 to before 1.1.1x; 1.0.2 to before 1.0.2zj Fixed in 3.2.1, 3.1.5, 3.0.13, 1.1.1x, 1.0.2zj Patch available CNA
  • cryptography (PyPI) Vendor— Affected before 42.0.2 Fixed in 42.0.2 Patch available GHSA-9v9h-cgj8-h64p

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*1.0.2 to before 1.0.2zj; 1.1.1 to before 1.1.1x; 3.0.0 to before 3.0.13; 3.1.0 to before 3.1.5VulnerableOpenSSL
cpe:2.3:a:openssl:openssl:3.2.0:-:*:*:*:*:*:*3.2.0VulnerableOpenSSL
  • cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions 1.0.2 to before 1.0.2zj; 1.1.1 to before 1.1.1x; 3.0.0 to before 3.0.13; 3.1.0 to before 3.1.5 Vulnerable ·OpenSSL
  • cpe:2.3:a:openssl:openssl:3.2.0:-:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·OpenSSL

Remediation

  • Fix · CNA OpenSSL (OpenSSL) Fixed in 3.2.1, 3.1.5, 3.0.13, 1.1.1x, 1.0.2zj
  • Fix · GHSA-9v9h-cgj8-h64p cryptography (PyPI) Fixed in 42.0.2 Advisory →

Red Hat 2 advisories

  • RHSA-2024:9088 Released 2024-11-12 · Red Hat rating Moderate
    edk2 security update
    • Red Hat CodeReady Linux Builder (v. 9) edk2-aarch64-20240524-6.el9_5, edk2-ovmf-20240524-6.el9_5, edk2-tools-20240524-6.el9_5 +1
    • Red Hat Enterprise Linux AppStream (v. 9) edk2-20240524-6.el9_5, edk2-aarch64-20240524-6.el9_5, edk2-ovmf-20240524-6.el9_5
  • RHSA-2024:2447 Released 2024-04-30 · Red Hat rating Low
    openssl and openssl-fips-provider security update
    • Red Hat Enterprise Linux AppStream (v. 9) openssl-devel-1:3.0.7-27.el9, openssl-perl-1:3.0.7-27.el9
    • Red Hat Enterprise Linux BaseOS (v. 9) openssl-1:3.0.7-27.el9, openssl-libs-1:3.0.7-27.el9

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat CodeReady Linux Builder (v. 9)Fixed RHSA-2024:9088
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2024:2447, RHSA-2024:9088
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2024:2447
Not affected: 3 products
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux BaseOS (v. 9)

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-0727
  2. 2026-10-03 Alias added: GHSA-9v9h-cgj8-h64p

References

Patch 5

Advisory 2

Other 13

  • TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
  • TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
  • TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
  • TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
  • TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8
See all 312 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences