# CVE-2024-0727: OpenSSL NULL pointer dereference in PKCS12 decoding

Source: https://junglewise.ai/threats/cve-2024-0727-openssl-null-pointer-dereference-in-pkcs12-decoding  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-01-26. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2024-0727 · Severity: medium · CVSS 5.5 · Published 2024-01-26

OpenSSL, a widely used security library for protecting data, is vulnerable to a crash when processing specifically crafted digital certificate files (PKCS12). If an application uses OpenSSL to load these files from an untrusted source, an attacker could cause the application to shut down unexpectedly. This results in a denial-of-service, potentially disrupting business operations or security services that rely on certificate processing.

Technologies: [OpenSSL](https://junglewise.ai/threats/technologies/openssl), [cryptography (PyPI)](https://junglewise.ai/threats/technologies/cryptography). Vendors: [OpenSSL](https://junglewise.ai/threats/vendors/openssl), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2024-0727 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-0727 being exploited in the wild.

**How severe is CVE-2024-0727?** Medium severity, with a CVSS score of 5.5, published 26 January 2024.

**Which products and versions are affected?** OpenSSL 3.2, 3.1, 3.0, 1.1.1, 1.0.2; cryptography (PyPI) < 42.0.2, ECOSYSTEM:introduced=0,fixed=42.0.2.

**Is there a fix for CVE-2024-0727?** Yes. cryptography (PyPI): upgrade to 42.0.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-0727 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2024-0727?** Check whether you run OpenSSL or cryptography (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- cryptography (PyPI): upgrade to 42.0.2 or later

  ```sh
  pip install "cryptography>=42.0.2"
  ```


## Technical details

A NULL pointer dereference vulnerability exists in OpenSSL's PKCS12 parsing logic. The PKCS12 specification allows certain fields to be NULL, but OpenSSL fails to correctly validate these fields during processing. An attacker can exploit this by providing a maliciously formatted PKCS12 file to an application using vulnerable APIs such as PKCS12_parse(), PKCS12_unpack_p7data(), or PKCS12_newpass(). Successful exploitation leads to an immediate application crash (Denial of Service). The issue is addressed in OpenSSL and downstream in the Python cryptography library version 42.0.2.

## Affected products

- OpenSSL OpenSSL 3.2, 3.1, 3.0, 1.1.1, 1.0.2
- PyCA cryptography < 42.0.2

## Identifiers

- CVE-2024-0727
- GHSA-9v9h-cgj8-h64p
- PYSEC-2026-1285

## Timeline

- 2024-01-25: advisory: Original OpenSSL security advisory published
- 2024-01-26: disclosed: GHSA published

## References

- [https://api.github.com/users/m3t3kh4n](https://api.github.com/users/m3t3kh4n)
- [https://github.com/m3t3kh4n](https://github.com/m3t3kh4n)
- [https://api.github.com/users/m3t3kh4n/gists%7B/gist_id%7D](https://api.github.com/users/m3t3kh4n/gists%7B/gist_id%7D)
- [https://api.github.com/users/m3t3kh4n/repos](https://api.github.com/users/m3t3kh4n/repos)
- [https://avatars.githubusercontent.com/u/112255413?v=4](https://avatars.githubusercontent.com/u/112255413?v=4)
- [https://api.github.com/users/m3t3kh4n/events%7B/privacy%7D](https://api.github.com/users/m3t3kh4n/events%7B/privacy%7D)

## Related threats

- [OpenSSL AES-GCM-SIV heap out-of-bounds read in EVP_CipherInit_ex](https://junglewise.ai/threats/cve-2026-95692-issue-summary-setting-an-aes-gcm-siv-iv-shorter-than-the-expected)
- [OpenSSL use-after-free in QUIC CRYPTO frame handling](https://junglewise.ai/threats/cve-2026-95691-issue-summary-a-retransmitted-quic-crypto-frame-can-release)
- [OpenSSL AES-GCM-SIV authentication tag bypass in AAD processing](https://junglewise.ai/threats/cve-2026-88823-issue-summary-the-aes-gcm-siv-implementation-treats-a-zero-length)
- [OpenSSL QUIC uninitialized stack data leak in peer detection](https://junglewise.ai/threats/cve-2026-88822-issue-summary-quic-when-performing-automated-peer-detection-may)
- [OpenSSL infinite loop in CMS encryption with EC certificates](https://junglewise.ai/threats/cve-2026-107496-issue-summary-encrypting-a-cms-message-to-an-ec-certificate)