Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack
Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly.
A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue.
OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass().
We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant.
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade openssl-develUpgrade edk2-aarch64Upgrade opensslUpgrade openssl-libsUpgrade edk2-toolsUpgrade openssl-perlUpgrade edk2-ovmfUpgrade edk2-tools-doc | May 8, 2024 | Jan 26, 2024 |
| Alpine Linux | — | Upgrade openssl | Mar 26, 2024 | Jan 26, 2024 |
| Amazon Linux Ami 2 | — | Upgrade edk2-ovmfUpgrade openssl-debuginfoUpgrade openssl-develUpgrade openssl-snapsafe-staticUpgrade openssl-libsUpgrade edk2-debuginfoUpgrade edk2-tools-pythonUpgrade edk2-aarch64Upgrade openssl11-libsUpgrade openssl-snapsafeUpgrade edk2-toolsUpgrade openssl11-staticUpgrade openssl-snapsafe-develUpgrade openssl11-develUpgrade openssl-perlUpgrade openssl-staticUpgrade edk2-tools-docUpgrade opensslUpgrade openssl11Upgrade openssl-snapsafe-perlUpgrade openssl-snapsafe-libsUpgrade openssl11-debuginfoUpgrade openssl-snapsafe-debuginfo | Mar 5, 2024 | Jan 26, 2024 |
| Amazon_linux_2023 | — | Upgrade opensslUpgrade openssl-libsUpgrade openssl-libs-debuginfoUpgrade openssl-debuginfoUpgrade openssl-debugsourceUpgrade openssl-develUpgrade openssl-snapsafe-libs-debuginfoUpgrade openssl-snapsafe-libsUpgrade openssl-perl | Feb 17, 2025 | Jan 22, 2024 |
| Debian | — | Upgrade openssl | Jul 30, 2024 | Jan 26, 2024 |
| Dell Poweredge Dsa2025255 | — | Upgrade Dell PowerEdge to the latest version | Jan 12, 2026 | Jun 23, 2025 |
| Freebsd | — | Upgrade openssl31Upgrade openssl32Upgrade opensslUpgrade openssl31-quictlsUpgrade openssl-quictls | Feb 1, 2024 | Jan 31, 2024 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Jun 5, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade opensslUpgrade openssl-perlUpgrade openssl-libs | May 13, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade sgx-aesm-serviceUpgrade libsgx-launchUpgrade libsgx-ae-leUpgrade libsgx-enclave-commonUpgrade libsgx-aesm-launch-pluginUpgrade libsgx-urts | Mar 13, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libsgx-urtsUpgrade libsgx-aesm-launch-pluginUpgrade libsgx-launchUpgrade sgx-aesm-serviceUpgrade libsgx-enclave-commonUpgrade libsgx-ae-le | May 31, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp5 | — | Upgrade shim-unsigned-x64 | Oct 8, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade shim-aa64 | Jul 23, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade openssl-perlUpgrade openssl-libsUpgrade openssl | Apr 9, 2024 | Jan 26, 2024 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory41 | Jul 17, 2024 | Jan 26, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Feb 21, 2024 |
| Oracle_linux | — | Upgrade openssl-perlUpgrade edk2-aarch64Upgrade edk2-toolsUpgrade opensslUpgrade openssl-fips-providerUpgrade openssl-libsUpgrade edk2-ovmfUpgrade edk2-tools-docUpgrade openssl-devel | May 7, 2024 | Jan 22, 2024 |
| Redhat_linux | — | Upgrade edk2-debugsourceUpgrade openssl-libs-debuginfoUpgrade edk2-tools-docUpgrade edk2-tools-debuginfoUpgrade openssl-perlUpgrade edk2-ovmfUpgrade opensslUpgrade openssl-fips-provider-debugsourceUpgrade openssl-debuginfoUpgrade openssl-libsUpgrade openssl-fips-providerUpgrade openssl-debugsourceUpgrade edk2-toolsNo solution existsUpgrade edk2-aarch64Upgrade openssl-fips-provider-debuginfoUpgrade openssl-devel | May 1, 2024 | Jan 26, 2024 |
| Rocky_linux | — | Upgrade edk2-tools-debuginfoUpgrade edk2-tools | Jul 16, 2024 | Jan 26, 2024 |
| Splunk | — | Upgrade Splunk Universal Forwarder to version 9.1.4Upgrade Splunk Universal Forwarder to version 9.0.9Upgrade Splunk Universal Forwarder to version 9.2.1Upgrade Splunk Enterprise to version 9.1.4Upgrade Splunk Enterprise to version 9.2.1Upgrade Splunk Enterprise to version 9.0.9 | Sep 30, 2025 | Jan 26, 2024 |
| Suse | — | Upgrade libopenssl1_1-32bitUpgrade openssl-3Upgrade libopenssl-1_1-develUpgrade libopenssl1_1-hmacUpgrade libopenssl-3-develUpgrade libopenssl-1_1-devel-32bitUpgrade openssl-1_1Upgrade libopenssl0_9_8-hmac-32bitUpgrade libopenssl0_9_8-32bitUpgrade openssl-docUpgrade libopenssl10Upgrade libopenssl1_0_0-hmac-32bitUpgrade libopenssl-3-fips-provider-x86-64-v3Upgrade libopenssl1_0_0-steamUpgrade openssl-1_0_0-docUpgrade libopenssl3-32bitUpgrade libopenssl-3-devel-32bitUpgrade libopenssl1-develUpgrade libopenssl-3-fips-provider-32bitUpgrade openssl-3-docUpgrade opensslUpgrade libopenssl1_1-hmac-32bitUpgrade libopenssl3Upgrade libopenssl0_9_8-hmacUpgrade openssl1-docUpgrade libopenssl1_0_0-hmacUpgrade libopenssl-3-fips-providerUpgrade libopenssl1_0_0-32bitUpgrade openssl1Upgrade libopenssl-1_0_0-devel-32bitUpgrade libopenssl1_0_0-steam-32bitUpgrade libopenssl-1_0_0-develUpgrade openssl-1_1-docUpgrade libopenssl1_1Upgrade libopenssl0_9_8Upgrade openssl-1_0_0-cavsUpgrade openssl-1_0_0Upgrade libopenssl3-x86-64-v3Upgrade libopenssl1_0_0 | Feb 19, 2024 | Jan 26, 2024 |
| Ubuntu | — | Upgrade ovmf-ia32Upgrade ovmfUpgrade libssl1.1 (Ubuntu Pro)Upgrade openssl (Ubuntu Pro)Upgrade qemu-efi-armUpgrade libssl1.0.0 (Ubuntu Pro)Upgrade qemu-efi-aarch64Upgrade qemu-efi-riscv64Upgrade qemu-efi-loongarch64Upgrade libssl3Upgrade libssl1.1Upgrade qemu-efi | Feb 6, 2024 | Jan 26, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub