CVE-2024-0727

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.

• CWE-476
• CWE-476

• https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2Patch
• https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844aPatch
• https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2cPatch
• https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8Patch
• https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539Patch
• https://www.openssl.org/news/secadv/20240125.txtVendor Advisory
• http://www.openwall.com/lists/oss-security/2024/03/11/1
• https://github.com/openssl/openssl/commit/09df4395b5071217b76dc7d3d2e630eb8c5a79c2Patch
• https://github.com/openssl/openssl/commit/775acfdbd0c6af9ac855f34969cdab0c0c90844aPatch
• https://github.com/openssl/openssl/commit/d135eeab8a5dbf72b3da5240bab9ddb7678dbd2cPatch
• https://github.openssl.org/openssl/extended-releases/commit/03b3941d60c4bce58fab69a0c22377ab439bc0e8Patch
• https://github.openssl.org/openssl/extended-releases/commit/aebaa5883e31122b404e450732dc833dc9dee539Patch
• https://lists.debian.org/debian-lts-announce/2024/10/msg00033.html
• https://lists.debian.org/debian-lts-announce/2024/11/msg00000.html
• https://security.netapp.com/advisory/ntap-20240208-0006/
• https://www.openssl.org/news/secadv/20240125.txtVendor Advisory
• https://cert-portal.siemens.com/productcert/html/ssa-265688.html
• https://cert-portal.siemens.com/productcert/html/ssa-277137.html
• https://cert-portal.siemens.com/productcert/html/ssa-331112.html
• https://cert-portal.siemens.com/productcert/html/ssa-769027.html
• https://cert-portal.siemens.com/productcert/html/ssa-915275.html

Published

Jan 26, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-0720A vulnerability, which was classified as problematic, was fo…6.1
• CVE-2024-0721A vulnerability has been found in Jspxcms 10.2.0 and classif…6.1
• CVE-2024-0722A vulnerability was found in code-projects Social Networking…5.4
• CVE-2024-0723A vulnerability was found in freeSSHd 1.0.9 on Windows. It h…7.5
• CVE-2024-0725A vulnerability was found in ProSSHD 1.2 on Windows. It has …7.5
• CVE-2024-0726A vulnerability was found in Project Worlds Student Project …6.1
• CVE-2024-0728A vulnerability classified as problematic was found in ForU …9.8
• CVE-2024-0729A vulnerability, which was classified as critical, has been …9.8
• CVE-2024-0730A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-0731A vulnerability has been found in PCMan FTP Server 2.0.7 and…7.5
• CVE-2024-0732A vulnerability was found in PCMan FTP Server 2.0.7 and clas…7.5
• CVE-2024-0733A vulnerability was found in Smsot up to 2.12. It has been c…9.8