Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack
Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly.
A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue.
OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass().
We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant.
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade edk2-toolsUpgrade edk2-tools-docUpgrade edk2-ovmfUpgrade openssl-libsUpgrade opensslUpgrade openssl-perlUpgrade openssl-develUpgrade edk2-aarch64 | May 8, 2024 | Jan 26, 2024 |
| Alpine Linux | — | Upgrade openssl | Mar 26, 2024 | Jan 26, 2024 |
| Amazon Linux Ami 2 | — | Upgrade openssl-develUpgrade openssl11-libsUpgrade openssl11-staticUpgrade edk2-toolsUpgrade openssl-snapsafeUpgrade openssl-libsUpgrade openssl-snapsafe-staticUpgrade edk2-aarch64Upgrade openssl-debuginfoUpgrade edk2-ovmfUpgrade edk2-tools-pythonUpgrade edk2-debuginfoUpgrade openssl-snapsafe-perlUpgrade openssl11-develUpgrade openssl-staticUpgrade openssl-snapsafe-libsUpgrade openssl11-debuginfoUpgrade openssl-perlUpgrade openssl-snapsafe-debuginfoUpgrade edk2-tools-docUpgrade opensslUpgrade openssl11Upgrade openssl-snapsafe-devel | Mar 5, 2024 | Jan 26, 2024 |
| Amazon_linux_2023 | — | Upgrade openssl-libsUpgrade openssl-debugsourceUpgrade openssl-libs-debuginfoUpgrade openssl-develUpgrade openssl-debuginfoUpgrade opensslUpgrade openssl-snapsafe-libs-debuginfoUpgrade openssl-perlUpgrade openssl-snapsafe-libs | Feb 17, 2025 | Jan 22, 2024 |
| Debian | — | Upgrade openssl | Jul 30, 2024 | Jan 26, 2024 |
| Dell Poweredge Dsa2025255 | — | Upgrade Dell PowerEdge to the latest version | Jan 12, 2026 | Jun 23, 2025 |
| Freebsd | — | Upgrade openssl32Upgrade openssl31Upgrade openssl-quictlsUpgrade opensslUpgrade openssl31-quictls | Feb 1, 2024 | Jan 31, 2024 |
| Http Openssl | — | Upgrade to the latest version of OpenSSL | Jun 5, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade openssl-libsUpgrade openssl-perlUpgrade openssl | May 13, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libsgx-ae-leUpgrade libsgx-launchUpgrade libsgx-urtsUpgrade libsgx-aesm-launch-pluginUpgrade libsgx-enclave-commonUpgrade sgx-aesm-service | Mar 13, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libsgx-aesm-launch-pluginUpgrade libsgx-launchUpgrade libsgx-urtsUpgrade sgx-aesm-serviceUpgrade libsgx-enclave-commonUpgrade libsgx-ae-le | May 31, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp5 | — | Upgrade shim-unsigned-x64 | Oct 8, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade shim-aa64 | Jul 23, 2024 | Jan 26, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade openssl-libsUpgrade openssl-perlUpgrade openssl | Apr 9, 2024 | Jan 26, 2024 |
| Ibm Aix | — | Apply the fix or workaround for openssl_advisory41 | Jul 17, 2024 | Jan 26, 2024 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Feb 21, 2024 |
| Oracle_linux | — | Upgrade opensslUpgrade openssl-perlUpgrade edk2-aarch64Upgrade edk2-toolsUpgrade openssl-libsUpgrade openssl-develUpgrade openssl-fips-providerUpgrade edk2-tools-docUpgrade edk2-ovmf | May 7, 2024 | Jan 22, 2024 |
| Redhat_linux | — | Upgrade edk2-debugsourceUpgrade opensslUpgrade edk2-tools-debuginfoUpgrade openssl-perlUpgrade edk2-ovmfUpgrade edk2-tools-docUpgrade openssl-libs-debuginfoNo solution existsUpgrade openssl-debuginfoUpgrade openssl-fips-provider-debuginfoUpgrade openssl-libsUpgrade openssl-debugsourceUpgrade edk2-toolsUpgrade openssl-fips-providerUpgrade openssl-fips-provider-debugsourceUpgrade openssl-develUpgrade edk2-aarch64 | May 1, 2024 | Jan 26, 2024 |
| Rocky_linux | — | Upgrade edk2-tools-debuginfoUpgrade edk2-tools | Jul 16, 2024 | Jan 26, 2024 |
| Splunk | — | Upgrade Splunk Universal Forwarder to version 9.0.9Upgrade Splunk Enterprise to version 9.1.4Upgrade Splunk Universal Forwarder to version 9.1.4Upgrade Splunk Universal Forwarder to version 9.2.1Upgrade Splunk Enterprise to version 9.0.9Upgrade Splunk Enterprise to version 9.2.1 | Sep 30, 2025 | Jan 26, 2024 |
| Suse | — | Upgrade openssl-1_0_0-docUpgrade openssl-3-docUpgrade libopenssl-1_1-develUpgrade libopenssl10Upgrade openssl-docUpgrade libopenssl-3-develUpgrade libopenssl-3-fips-provider-32bitUpgrade libopenssl1_0_0-steamUpgrade libopenssl1_1-hmacUpgrade libopenssl1-develUpgrade openssl-3Upgrade libopenssl-3-fips-provider-x86-64-v3Upgrade libopenssl1_1-32bitUpgrade libopenssl-3-devel-32bitUpgrade libopenssl0_9_8-hmac-32bitUpgrade libopenssl3-32bitUpgrade libopenssl0_9_8-32bitUpgrade libopenssl1_0_0-hmac-32bitUpgrade openssl-1_1Upgrade libopenssl-1_1-devel-32bitUpgrade libopenssl1_0_0-steam-32bitUpgrade libopenssl-3-fips-providerUpgrade libopenssl3-x86-64-v3Upgrade libopenssl1_1-hmac-32bitUpgrade opensslUpgrade libopenssl0_9_8-hmacUpgrade openssl1-docUpgrade libopenssl3Upgrade libopenssl-1_0_0-devel-32bitUpgrade openssl1Upgrade libopenssl1_0_0-32bitUpgrade libopenssl-1_0_0-develUpgrade openssl-1_1-docUpgrade libopenssl0_9_8Upgrade openssl-1_0_0Upgrade openssl-1_0_0-cavsUpgrade libopenssl1_0_0-hmacUpgrade libopenssl1_1Upgrade libopenssl1_0_0 | Feb 19, 2024 | Jan 26, 2024 |
| Ubuntu | — | Upgrade libssl1.0.0 (Ubuntu Pro)Upgrade ovmf-ia32Upgrade libssl1.1 (Ubuntu Pro)Upgrade openssl (Ubuntu Pro)Upgrade ovmfUpgrade qemu-efi-armUpgrade qemu-efi-loongarch64Upgrade qemu-efiUpgrade qemu-efi-aarch64Upgrade qemu-efi-riscv64Upgrade libssl3Upgrade libssl1.1 | Feb 6, 2024 | Jan 26, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jan 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub