CVE-2024-12797

Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys may be vulnerable to man-in-middle attacks when server authentication failure is not detected by clients. RPKs are disabled by default in both TLS clients and TLS servers. The issue only arises when TLS clients explicitly enable RPK use by the server, and the server, likewise, enables sending of an RPK instead of an X.509 certificate chain. The affected clients are those that then rely on the handshake to fail when the server's RPK fails to match one of the expected public keys, by setting the verification mode to SSL_VERIFY_PEER. Clients that enable server-side raw public keys can still find out that raw public key verification failed by calling SSL_get_verify_result(), and those that do, and take appropriate action, are not affected. This issue was introduced in the initial implementation of RPK support in OpenSSL 3.2. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

• CWE-392

• https://github.com/openssl/openssl/commit/738d4f9fdeaad57660dcba50a619fafced3fd5e9
• https://github.com/openssl/openssl/commit/798779d43494549b611233f92652f0da5328fbe7
• https://github.com/openssl/openssl/commit/87ebd203feffcf92ad5889df92f90bb0ee10a699
• https://openssl-library.org/news/secadv/20250211.txt
• http://www.openwall.com/lists/oss-security/2025/02/11/3
• http://www.openwall.com/lists/oss-security/2025/02/11/4
• https://security.netapp.com/advisory/ntap-20250214-0001/

Published

Feb 11, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12790A vulnerability was found in code-projects Hostel Management…8.2
• CVE-2024-12791A vulnerability was found in Codezips E-Commerce Site 1.0. I…9.8
• CVE-2024-12792A vulnerability classified as critical was found in Codezips…9.8
• CVE-2024-12793A vulnerability, which was classified as problematic, has be…4.3
• CVE-2024-12794A vulnerability, which was classified as critical, was found…9.8
• CVE-2024-12796Improper Neutralization of Input During Web Page Generation …5.3
• CVE-2024-12798ACE vulnerability in JaninoEventEvaluator by QOS.CH logback…5.9
• CVE-2024-12799Insufficiently Protected Credentials vulnerability in OpenTe…10
• CVE-2024-12800The IP Based Login WordPress plugin before 2.4.1 does not sa…4.8
• CVE-2024-12801Server-Side Request Forgery (SSRF) in SaxEventRecorder by QO…2.4
• CVE-2024-12802SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specifi…9.1
• CVE-2024-12803A post-authentication stack-based buffer overflow vulnerabil…7.2