Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack
Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly.
A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue.
OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass().
We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant.
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssl-develUpgrade edk2-aarch64Upgrade openssl-libsUpgrade opensslUpgrade edk2-toolsUpgrade edk2-tools-docUpgrade edk2-ovmfUpgrade openssl-perl | May 8, 2024 | Jan 26, 2024 |
| Alpine Linux | — | Upgrade openssl | Mar 26, 2024 | Jan 26, 2024 |
| Amazon Linux Ami 2 | — | Upgrade openssl11Upgrade openssl-snapsafe-libsUpgrade openssl-snapsafe-perlUpgrade openssl-snapsafe-debuginfoUpgrade openssl-staticUpgrade openssl11-develUpgrade opensslUpgrade openssl-perlUpgrade openssl-snapsafe-develUpgrade openssl11-debuginfoUpgrade edk2-tools-docUpgrade openssl-libsUpgrade edk2-tools-pythonUpgrade edk2-debuginfoUpgrade openssl-debuginfoUpgrade edk2-ovmfUpgrade openssl-snapsafeUpgrade edk2-aarch64Upgrade edk2-toolsUpgrade openssl11-libsUpgrade openssl11-staticUpgrade openssl-snapsafe-staticUpgrade openssl-devel | Mar 5, 2024 | Jan 26, 2024 |
| Amazon_linux_2023 | — | Upgrade opensslUpgrade openssl-debugsourceUpgrade openssl-develUpgrade openssl-libsUpgrade openssl-libs-debuginfoUpgrade openssl-debuginfoUpgrade openssl-snapsafe-libs-debuginfoUpgrade openssl-snapsafe-libsUpgrade openssl-perl | Feb 17, 2025 | Jan 22, 2024 |
| Debian | — | Upgrade openssl | Jul 30, 2024 | Jan 26, 2024 |
| Dell Poweredge Dsa2025255 | — | Upgrade Dell PowerEdge to the latest version | Jan 12, 2026 | Jun 23, 2025 |
| Freebsd | — | Upgrade openssl31Upgrade openssl32Upgrade openssl-quictlsUpgrade opensslUpgrade openssl31-quictls | Feb 1, 2024 | Jan 31, 2024 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Jun 5, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade openssl-libsUpgrade openssl-perlUpgrade openssl | May 13, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libsgx-launchUpgrade libsgx-ae-leUpgrade libsgx-aesm-launch-pluginUpgrade sgx-aesm-serviceUpgrade libsgx-enclave-commonUpgrade libsgx-urts | Mar 13, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libsgx-ae-leUpgrade libsgx-enclave-commonUpgrade sgx-aesm-serviceUpgrade libsgx-urtsUpgrade libsgx-launchUpgrade libsgx-aesm-launch-plugin | May 31, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp5 | — | Upgrade shim-unsigned-x64 | Oct 8, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade shim-aa64 | Jul 23, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade openssl-perlUpgrade openssl-libsUpgrade openssl | Apr 9, 2024 | Jan 26, 2024 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory41 | Jul 17, 2024 | Jan 26, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Feb 21, 2024 |
| Oracle_linux | — | Upgrade openssl-libsUpgrade edk2-tools-docUpgrade edk2-ovmfUpgrade openssl-develUpgrade openssl-fips-providerUpgrade edk2-aarch64Upgrade opensslUpgrade openssl-perlUpgrade edk2-tools | May 7, 2024 | Jan 22, 2024 |
| Redhat_linux | — | No solution existsUpgrade openssl-develUpgrade openssl-fips-provider-debuginfoUpgrade openssl-fips-provider-debugsourceUpgrade edk2-toolsUpgrade openssl-debuginfoUpgrade openssl-libsUpgrade edk2-aarch64Upgrade openssl-fips-providerUpgrade openssl-debugsourceUpgrade edk2-tools-docUpgrade edk2-ovmfUpgrade opensslUpgrade openssl-perlUpgrade edk2-debugsourceUpgrade openssl-libs-debuginfoUpgrade edk2-tools-debuginfo | May 1, 2024 | Jan 26, 2024 |
| Rocky_linux | — | Upgrade edk2-tools-debuginfoUpgrade edk2-tools | Jul 16, 2024 | Jan 26, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.9Upgrade Splunk Enterprise to version 9.2.1Upgrade Splunk Universal Forwarder to version 9.0.9Upgrade Splunk Enterprise to version 9.1.4Upgrade Splunk Universal Forwarder to version 9.2.1Upgrade Splunk Universal Forwarder to version 9.1.4 | Sep 30, 2025 | Jan 26, 2024 |
| Suse | — | Upgrade libopenssl1_0_0-steam-32bitUpgrade libopenssl1_1Upgrade libopenssl3Upgrade libopenssl3-x86-64-v3Upgrade libopenssl1_0_0Upgrade libopenssl0_9_8-hmacUpgrade openssl-1_0_0Upgrade openssl1Upgrade opensslUpgrade openssl1-docUpgrade libopenssl1_1-hmac-32bitUpgrade openssl-1_0_0-cavsUpgrade libopenssl0_9_8Upgrade libopenssl-3-fips-providerUpgrade libopenssl1_0_0-hmacUpgrade libopenssl1_0_0-32bitUpgrade libopenssl-1_0_0-devel-32bitUpgrade openssl-1_1-docUpgrade libopenssl-1_0_0-develUpgrade libopenssl0_9_8-32bitUpgrade libopenssl1-develUpgrade libopenssl3-32bitUpgrade libopenssl0_9_8-hmac-32bitUpgrade libopenssl-3-develUpgrade libopenssl1_1-32bitUpgrade openssl-3-docUpgrade libopenssl1_0_0-steamUpgrade libopenssl-3-fips-provider-x86-64-v3Upgrade libopenssl1_0_0-hmac-32bitUpgrade openssl-1_0_0-docUpgrade libopenssl10Upgrade libopenssl-1_1-devel-32bitUpgrade openssl-1_1Upgrade openssl-docUpgrade libopenssl-3-devel-32bitUpgrade libopenssl-1_1-develUpgrade libopenssl-3-fips-provider-32bitUpgrade libopenssl1_1-hmacUpgrade openssl-3 | Feb 19, 2024 | Jan 26, 2024 |
| Ubuntu | — | Upgrade libssl3Upgrade libssl1.1Upgrade qemu-efi-loongarch64Upgrade qemu-efi-riscv64Upgrade qemu-efi-aarch64Upgrade qemu-efiUpgrade qemu-efi-armUpgrade libssl1.1 (Ubuntu Pro)Upgrade libssl1.0.0 (Ubuntu Pro)Upgrade openssl (Ubuntu Pro)Upgrade ovmfUpgrade ovmf-ia32 | Feb 6, 2024 | Jan 26, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub