CVE-2024-0727: OpenSSL NULL pointer dereference in PKCS12 decoding

CVE-2024-0727 · Severity: medium · CVSS 5.5 · Published 2024-01-26

OpenSSL, a widely used security library for protecting data, is vulnerable to a crash when processing specifically crafted digital certificate files (PKCS12). If an application uses OpenSSL to load these files from an untrusted source, an attacker could cause the application to shut down unexpectedly. This results in a denial-of-service, potentially disrupting business operations or security services that rely on certificate processing.

Technologies: OpenSSL, cryptography (PyPI). Vendors: OpenSSL, PyPI.

Quick answers

Is CVE-2024-0727 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-0727 being exploited in the wild.
How severe is CVE-2024-0727?
Medium severity, with a CVSS score of 5.5, published 26 January 2024.
Which products and versions are affected?
OpenSSL 3.2, 3.1, 3.0, 1.1.1, 1.0.2; cryptography (PyPI) < 42.0.2, ECOSYSTEM:introduced=0,fixed=42.0.2.
Is there a fix for CVE-2024-0727?
Yes. cryptography (PyPI): upgrade to 42.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-0727 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2024-0727?
Check whether you run OpenSSL or cryptography (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • cryptography (PyPI): upgrade to 42.0.2 or later
    pip install "cryptography>=42.0.2"

Technical details

A NULL pointer dereference vulnerability exists in OpenSSL's PKCS12 parsing logic. The PKCS12 specification allows certain fields to be NULL, but OpenSSL fails to correctly validate these fields during processing. An attacker can exploit this by providing a maliciously formatted PKCS12 file to an application using vulnerable APIs such as PKCS12_parse(), PKCS12_unpack_p7data(), or PKCS12_newpass(). Successful exploitation leads to an immediate application crash (Denial of Service). The issue is addressed in OpenSSL and downstream in the Python cryptography library version 42.0.2.

Affected products

  • OpenSSL OpenSSL 3.2, 3.1, 3.0, 1.1.1, 1.0.2
  • PyCA cryptography < 42.0.2

Identifiers

  • CVE-2024-0727
  • GHSA-9v9h-cgj8-h64p
  • PYSEC-2026-1285

Timeline

  • 2024-01-25: advisory: Original OpenSSL security advisory published
  • 2024-01-26: disclosed: GHSA published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.