CVE-2024-0727: PKCS12 Decoding crashes
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack
Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly.
A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue.
OpenSSL APIs that are vulnerable to this are: PKCS12parse(), PKCS12unpackp7data(), PKCS12unpackp7encdata(), PKCS12unpackauthsafes() and PKCS12newpass().
We have also fixed a similar issue in SMIMEwritePKCS7(). However since this function is related to writing data we do not consider it security significant.
The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.
Other sources
OpenSSL is vulnerable to a denial of service, caused by improper input validation. By persuading a victim to open a specially crafted PKCS12 file, a remote attacker could exploit this vulnerability to cause the application to crash.
— IBM
PKCS12 structures contain PKCS7 ContentInfo fields. These fields are optional and can be NULL even if the "type" is a valid value. OpenSSL was not properly accounting for this and a NULL dereference can occur causing a crash. The OpenSSL project did announce a new release, which is assumed to contain this bug fix; that release will be published on Jan 30th.
Reference: https://github.com/openssl/openssl/pull/23362
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0727?
CVE-2024-0727 is classified as a Denial of Service vulnerability due to potential application crashes.
How do I fix CVE-2024-0727?
To fix CVE-2024-0727, update OpenSSL to the recommended versions or later, such as 1.1.1w-0+deb11u2 or 3.2.0.
Which versions are affected by CVE-2024-0727?
CVE-2024-0727 affects multiple versions of OpenSSL, specifically those prior to 1.1.1x, 3.0.13, and 3.1.5.
Can CVE-2024-0727 be exploited remotely?
CVE-2024-0727 can potentially be exploited when applications process malformed PKCS12 files from untrusted sources.
What impact does CVE-2024-0727 have on systems?
The impact of CVE-2024-0727 includes application crashes, leading to potential downtime and service availability issues.