Skip to content
Fencer Vulns
high 7.4

CVE-2024-12797 json

RFC7250 handshakes with unauthenticated servers don't abort as expected

published 2025-02-11 20 mo ago modified 2026-11-06 2 d ago also EUVD-2024-51115 , GHSA-79v4-65xg-pq4g , PYSEC-2026-1284

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.9%
EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set.

Impact summary: TLS and DTLS connections using raw public keys may be vulnerable to man-in-middle attacks when server authentication failure is not detected by clients.

RPKs are disabled by default in both TLS clients and TLS servers. The issue only arises when TLS clients explicitly enable RPK use by the server, and the server, likewise, enables sending of an RPK instead of an X.509 certificate chain. The affected clients are those that then rely on the handshake to fail when the server's RPK fails to match one of the expected public keys, by setting the verification mode to SSL_VERIFY_PEER.

Clients that enable server-side raw public keys can still find out that raw public key verification failed by calling SSL_get_verify_result(), and those that do, and take appropriate action, are not affected. This issue was introduced in the initial implementation of RPK support in OpenSSL 3.2.

The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

Patch / fix

  • pypi cryptography 44.0.1
  • OpenSSL OpenSSL 3.2.4, 3.3.3, 3.4.1
  • openssl Debian 14, Debian 13 3.4.1-1

debian advisories DEBIAN-CVE-2024-12797

  • openssl RHEL 10.0 1:3.2.2-16.el10
  • openssl-libs RHEL 10.0 1:3.2.2-16.el10
  • openssl-perl RHEL 10.0 1:3.2.2-16.el10
  • openssl RHEL 9 1:3.2.2-6.el9_5.1
  • openssl-libs RHEL 9 1:3.2.2-6.el9_5.1
  • openssl-perl RHEL 9 1:3.2.2-6.el9_5.1

red hat advisories RHBA-2025:6314RHSA-2025:1330

  • openssl-3 SLE Module for Basesystem 15 SP7 3.2.3-150700.5.5.1

suse advisories SUSE-SU-2025:02042-1

  • openssl-3 openSUSE Tumbleweed 3.2.4-1.1

opensuse advisories openSUSE-SU-2025:14802-1

  • openssl AlmaLinux 9 1:3.2.2-6.el9_5.1
  • openssl-libs AlmaLinux 9 1:3.2.2-6.el9_5.1
  • openssl-perl AlmaLinux 9 1:3.2.2-6.el9_5.1

almalinux advisories ALSA-2025:1330

  • openssl Rocky Linux 9 1:3.2.2-6.el9_5.1

rocky linux advisories RLSA-2025:1330

  • openssl Alpine 3.24, Alpine 3.23, Alpine 3.22 +2 more 3.3.3-r0

alpine advisories ALPINE-CVE-2024-12797

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • cloud-hypervisor-cvm CBL-Mariner 2.0 38.0.72.2-5
  • openssl Azure Linux 3.0 3.3.3-1

azure linux advisories AZL-56761AZL-56774

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-12797 updated cvss 7.4

openssl: RFC7250 handshakes with unauthenticated servers don't abort as expected

  • Red Hat Enterprise Linux 10 flatpak-sdk-container
    affected: workaround, no fix available
  • Red Hat Builds for Red Hat OpenShift 1.3.2 openshift-builds 1.3.1-1741784043, openshift-builds 1.3.1-1741784401, openshift-builds 1.3.1-1741805006
    fixed: vendor fix RHSA-2025:2754
  • Red Hat Discovery 1 for RHEL 9 discovery/discovery-ui-rhel9 1.12.0-2, discovery/discovery-server-rhel9 1.12.1-2
    fixed: vendor fix RHSA-2025:1487
  • Red Hat Enterprise Linux AppStream (v. 9) openssl-perl 3.2.2-6.el9_5.1
    fixed: vendor fix RHSA-2025:1330
  • Red Hat Enterprise Linux AppStream (v. 10) openssl-perl 3.2.2-16.el10
    fixed: vendor fix RHBA-2025:6314
  • Red Hat Enterprise Linux BaseOS (v. 9) openssl 3.2.2-6.el9_5.1, openssl-libs 3.2.2-6.el9_5.1
    fixed: vendor fix RHSA-2025:1330
  • Red Hat Enterprise Linux BaseOS (v. 10) openssl 3.2.2-16.el10, openssl-libs 3.2.2-16.el10
    fixed: vendor fix RHBA-2025:6314
  • Red Hat Service Interconnect 1 service-interconnect/skupper-router-rhel9 2.5.3-7, service-interconnect/skupper-router-rhel9 2.7.5-2, service-interconnect/skupper-operator-bundle 1.5.5-5, service-interconnect/skupper-operator-bundle 1.8.5-2, service-interconnect/skupper-config-sync-rhel9 1.5.5-5, service-interconnect/skupper-config-sync-rhel9 1.8.5-1, +10 more
    fixed: vendor fix RHSA-2025:1925
show 3 more
  • Red Hat Service Interconnect 1.4 service-interconnect/skupper-router-rhel9 2.4.3-9, service-interconnect/skupper-operator-bundle 1.4.8-1, service-interconnect/skupper-config-sync-rhel9 1.4.8-1, service-interconnect/skupper-flow-collector-rhel9 1.4.8-1, service-interconnect/skupper-site-controller-rhel9 1.4.8-1, service-interconnect/skupper-service-controller-rhel9 1.4.8-1
    fixed: vendor fix RHSA-2025:9895
  • Red Hat RHOL 5.9 for RHEL 9 openshift-logging/fluentd-rhel9 v5.9.12-3, openshift-logging/vector-rhel9 v0.34.1-33, openshift-logging/eventrouter-rhel9 v0.4.0-341, openshift-logging/logging-loki-rhel9 v3.3.2-16, openshift-logging/loki-rhel9-operator v5.9.12-4, openshift-logging/opa-openshift-rhel9 v0.1.0-351, +6 more
    fixed: vendor fix RHSA-2025:1985
  • Red Hat Builds for Red Hat OpenShift 1.3.2 openshift-builds 1.3.1-1741768114, openshift-builds 1.3.1-1741770382, openshift-builds 1.3.1-1741771156, openshift-builds 1.3.1-1741772590, openshift-builds 1.3.1-1741782941, openshift-builds 1.3.1-1741819738, +1 more Red Hat 3scale API Management Platform 2 3scale-amp2/backend-rhel7 Red Hat Enterprise Linux 6 openssl, openssl-perl Red Hat Enterprise Linux 7 ovmf, OVMF, AAVMF, openssl, openssl-libs, openssl-perl Red Hat Enterprise Linux 8 edk2, shim, openssl, shim-x64, edk2-ovmf, shim-aa64, +9 more Red Hat Enterprise Linux 9 edk2, shim, ruby-30, ruby-33, shim-x64, edk2-ovmf, +6 more
    +3 more products
    Red Hat Enterprise Linux 10 edk2, shim Red Hat JBoss Core Services openssl Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 d ago

Exploit prediction

1.86% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected packages

ecosystem package affected fixed in
pypi cryptography
>=42.0.0, <44.0.1
44.0.1

Affected products

  • OpenSSL OpenSSL

Classification

Weakness
  • CWE-392 Missing Report of Error Condition
  • CWE-1395 Dependency on Vulnerable Third-Party Component
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.