Executive brief
OpenSSL, a widely used security library for protecting data, is vulnerable to a crash when processing specifically crafted digital certificate files (PKCS12). If an application uses OpenSSL to load these files from an untrusted source, an attacker could cause the application to shut down unexpectedly. This results in a denial-of-service, potentially disrupting business operations or security services that rely on certificate processing.
Technical details
A NULL pointer dereference vulnerability exists in OpenSSL's PKCS12 parsing logic. The PKCS12 specification allows certain fields to be NULL, but OpenSSL fails to correctly validate these fields during processing. An attacker can exploit this by providing a maliciously formatted PKCS12 file to an application using vulnerable APIs such as PKCS12_parse(), PKCS12_unpack_p7data(), or PKCS12_newpass(). Successful exploitation leads to an immediate application crash (Denial of Service). The issue is addressed in OpenSSL and downstream in the Python cryptography library version 42.0.2.
Affected products
- OpenSSL OpenSSL 3.2, 3.1, 3.0, 1.1.1, 1.0.2
- PyCA cryptography < 42.0.2
Timeline
- 2024-01-25: advisory: Original OpenSSL security advisory published
- 2024-01-26: disclosed: GHSA published