CVE-2024-0727

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack

Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly.

A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue.

OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass().

We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant.

The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.

Weakness

The product dereferences a pointer that it expects to be valid but is NULL.

Affected Software

Name	Vendor	Start Version	End Version
Openssl	Openssl	1.0.2 (including)	1.0.2zj (excluding)
Openssl	Openssl	1.1.1 (including)	1.1.1x (excluding)
Openssl	Openssl	3.0.0 (including)	3.0.13 (excluding)
Openssl	Openssl	3.1.0 (including)	3.1.5 (excluding)
Openssl	Openssl	3.2.0 (including)	3.2.0 (including)
Red Hat Enterprise Linux 9	RedHat	openssl-1:3.0.7-27.el9	*
Red Hat Enterprise Linux 9	RedHat	edk2-0:20240524-6.el9_5	*
Red Hat Enterprise Linux 9	RedHat	openssl-1:3.0.7-27.el9	*
Edk2	Ubuntu	bionic	*
Edk2	Ubuntu	esm-infra/focal	*
Edk2	Ubuntu	focal	*
Edk2	Ubuntu	jammy	*
Edk2	Ubuntu	lunar	*
Edk2	Ubuntu	mantic	*
Edk2	Ubuntu	noble	*
Edk2	Ubuntu	oracular	*
Edk2	Ubuntu	trusty	*
Edk2	Ubuntu	xenial	*
Nodejs	Ubuntu	esm-apps/jammy	*
Nodejs	Ubuntu	jammy	*
Nodejs	Ubuntu	trusty	*
Openssl	Ubuntu	bionic	*
Openssl	Ubuntu	devel	*
Openssl	Ubuntu	esm-infra-legacy/trusty	*
Openssl	Ubuntu	esm-infra/bionic	*
Openssl	Ubuntu	esm-infra/focal	*
Openssl	Ubuntu	esm-infra/xenial	*
Openssl	Ubuntu	fips-preview/jammy	*
Openssl	Ubuntu	fips-updates/bionic	*
Openssl	Ubuntu	fips-updates/focal	*
Openssl	Ubuntu	fips-updates/jammy	*
Openssl	Ubuntu	fips-updates/xenial	*
Openssl	Ubuntu	fips/bionic	*
Openssl	Ubuntu	fips/focal	*
Openssl	Ubuntu	fips/xenial	*
Openssl	Ubuntu	focal	*
Openssl	Ubuntu	jammy	*
Openssl	Ubuntu	lunar	*
Openssl	Ubuntu	mantic	*
Openssl	Ubuntu	noble	*
Openssl	Ubuntu	oracular	*
Openssl	Ubuntu	plucky	*
Openssl	Ubuntu	questing	*
Openssl	Ubuntu	trusty	*
Openssl	Ubuntu	trusty/esm	*
Openssl	Ubuntu	upstream	*
Openssl	Ubuntu	xenial	*
Openssl1.0	Ubuntu	bionic	*
Openssl1.0	Ubuntu	esm-infra/bionic	*
Openssl1.0	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2024-0727
CWE	https://cwe.mitre.org/data/definitions/476.html

NULL Pointer Dereference

Weakness

Affected Software

Potential Mitigations

References