Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack
Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly.
A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue.
OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass().
We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant.
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade edk2-aarch64Upgrade openssl-develUpgrade edk2-tools-docUpgrade opensslUpgrade openssl-libsUpgrade edk2-ovmfUpgrade edk2-toolsUpgrade openssl-perl | May 8, 2024 | Jan 26, 2024 |
| Alpine Linux | — | Upgrade openssl | Mar 26, 2024 | Jan 26, 2024 |
| Amazon Linux Ami 2 | — | Upgrade openssl-snapsafe-libsUpgrade openssl11-debuginfoUpgrade edk2-tools-docUpgrade openssl-perlUpgrade openssl-staticUpgrade openssl-snapsafe-debuginfoUpgrade opensslUpgrade openssl-snapsafe-develUpgrade openssl11Upgrade openssl11-develUpgrade openssl-snapsafe-perlUpgrade edk2-toolsUpgrade edk2-ovmfUpgrade openssl-snapsafe-staticUpgrade edk2-tools-pythonUpgrade edk2-debuginfoUpgrade openssl-develUpgrade openssl-libsUpgrade openssl-debuginfoUpgrade openssl11-staticUpgrade openssl11-libsUpgrade edk2-aarch64Upgrade openssl-snapsafe | Mar 5, 2024 | Jan 26, 2024 |
| Amazon_linux_2023 | — | Upgrade openssl-snapsafe-libsUpgrade openssl-snapsafe-libs-debuginfoUpgrade openssl-perlUpgrade openssl-debuginfoUpgrade opensslUpgrade openssl-debugsourceUpgrade openssl-libsUpgrade openssl-libs-debuginfoUpgrade openssl-devel | Feb 17, 2025 | Jan 22, 2024 |
| Debian | — | Upgrade openssl | Jul 30, 2024 | Jan 26, 2024 |
| Dell Poweredge Dsa2025255 | — | Upgrade Dell PowerEdge to the latest version | Jan 12, 2026 | Jun 23, 2025 |
| Freebsd | — | Upgrade openssl31-quictlsUpgrade opensslUpgrade openssl-quictlsUpgrade openssl32Upgrade openssl31 | Feb 1, 2024 | Jan 31, 2024 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Jun 5, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade opensslUpgrade openssl-perlUpgrade openssl-libs | May 13, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade sgx-aesm-serviceUpgrade libsgx-enclave-commonUpgrade libsgx-urtsUpgrade libsgx-aesm-launch-pluginUpgrade libsgx-ae-leUpgrade libsgx-launch | Mar 13, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libsgx-launchUpgrade libsgx-aesm-launch-pluginUpgrade libsgx-urtsUpgrade sgx-aesm-serviceUpgrade libsgx-enclave-commonUpgrade libsgx-ae-le | May 31, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp5 | — | Upgrade shim-unsigned-x64 | Oct 8, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade shim-aa64 | Jul 23, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade openssl-libsUpgrade openssl-perlUpgrade openssl | Apr 9, 2024 | Jan 26, 2024 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory41 | Jul 17, 2024 | Jan 26, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Feb 21, 2024 |
| Oracle_linux | — | Upgrade openssl-libsUpgrade edk2-tools-docUpgrade edk2-ovmfUpgrade openssl-fips-providerUpgrade openssl-develUpgrade edk2-toolsUpgrade opensslUpgrade edk2-aarch64Upgrade openssl-perl | May 7, 2024 | Jan 22, 2024 |
| Redhat_linux | — | Upgrade opensslUpgrade edk2-tools-docUpgrade edk2-tools-debuginfoUpgrade openssl-perlUpgrade openssl-libs-debuginfoUpgrade edk2-debugsourceUpgrade edk2-ovmfUpgrade openssl-fips-providerUpgrade openssl-fips-provider-debugsourceUpgrade openssl-develUpgrade openssl-debugsourceNo solution existsUpgrade openssl-fips-provider-debuginfoUpgrade edk2-aarch64Upgrade openssl-debuginfoUpgrade openssl-libsUpgrade edk2-tools | May 1, 2024 | Jan 26, 2024 |
| Rocky_linux | — | Upgrade edk2-tools-debuginfoUpgrade edk2-tools | Jul 16, 2024 | Jan 26, 2024 |
| Splunk | — | Upgrade Splunk Universal Forwarder to version 9.2.1Upgrade Splunk Enterprise to version 9.1.4Upgrade Splunk Universal Forwarder to version 9.1.4Upgrade Splunk Universal Forwarder to version 9.0.9Upgrade Splunk Enterprise to version 9.2.1Upgrade Splunk Enterprise to version 9.0.9 | Sep 30, 2025 | Jan 26, 2024 |
| Suse | — | Upgrade libopenssl-3-fips-providerUpgrade libopenssl1_0_0Upgrade libopenssl1_0_0-32bitUpgrade libopenssl1_0_0-hmacUpgrade libopenssl-1_0_0-devel-32bitUpgrade openssl1Upgrade openssl-1_1-docUpgrade libopenssl0_9_8Upgrade libopenssl3-x86-64-v3Upgrade openssl-1_0_0-cavsUpgrade libopenssl1_1Upgrade libopenssl-1_0_0-develUpgrade libopenssl0_9_8-hmacUpgrade libopenssl1_0_0-steam-32bitUpgrade openssl-1_0_0Upgrade opensslUpgrade openssl1-docUpgrade libopenssl3Upgrade libopenssl1_1-hmac-32bitUpgrade libopenssl-3-devel-32bitUpgrade libopenssl0_9_8-hmac-32bitUpgrade openssl-3-docUpgrade libopenssl1_1-32bitUpgrade libopenssl1_0_0-hmac-32bitUpgrade libopenssl3-32bitUpgrade libopenssl-3-fips-provider-x86-64-v3Upgrade libopenssl-1_1-develUpgrade openssl-1_0_0-docUpgrade openssl-1_1Upgrade libopenssl10Upgrade libopenssl-1_1-devel-32bitUpgrade openssl-docUpgrade libopenssl-3-develUpgrade libopenssl1_0_0-steamUpgrade libopenssl1_1-hmacUpgrade openssl-3Upgrade libopenssl0_9_8-32bitUpgrade libopenssl1-develUpgrade libopenssl-3-fips-provider-32bit | Feb 19, 2024 | Jan 26, 2024 |
| Ubuntu | — | Upgrade ovmf-ia32Upgrade libssl1.0.0 (Ubuntu Pro)Upgrade libssl1.1 (Ubuntu Pro)Upgrade qemu-efi-armUpgrade ovmfUpgrade openssl (Ubuntu Pro)Upgrade libssl3Upgrade libssl1.1Upgrade qemu-efi-riscv64Upgrade qemu-efi-aarch64Upgrade qemu-efiUpgrade qemu-efi-loongarch64 | Feb 6, 2024 | Jan 26, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub