CVE-2024-12797
highpriority · track · 1EPSS 0.025 · 85 %ileDEEUNLRUUSEPSS · scored 2026-10-26
Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys may be vulnerable to man-in-middle attacks when server authentication failure is not detected by clients. RPKs are disabled by default in both TLS clients and TLS servers. The issue only arises when TLS clients explicitly enable RPK use by the server, and the server, likewise, enables sending of an RPK instead of an X.509 certificate chain. The affected clients are those that then rely on the handshake to fail when the server's RPK fails to match one of the expected public keys, by setting the verification mode to SSL_VERIFY_PEER. Clients that enable server-side raw public keys can still find out that raw public key verification failed by calling SSL_get_verify_result(), and those that do, and take appropriate action, are not affected. This issue was introduced in the initial implementation of RPK support in OpenSSL 3.2. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.8–7.4
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (196)
Products and version ranges known to be affected.
- Red Hat Enterprise Linux Discovery 1all versionscert_bundDEcpe:/o:redhat:enterprise_linux:discovery_1
- Red Hat Enterprise Linux Service Interconnect 1all versionscert_bundDEcpe:/o:redhat:enterprise_linux:service_interconnect_1
- Red Hat Enterprise Linux Service Interconnect 1.4all versionscert_bundDEcpe:/o:redhat:enterprise_linux:service_interconnect_1.4
advisories (9)
Vendor and ecosystem advisories describing this.
- NCSC-2025-0124Kwetsbaarheden verholpen in Oracle CommunicationsNL2025-04-16csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in Oracle Communications producten, waaronder de Cloud Native Core en Policy Management.
- NCSC-2025-0335Kwetsbaarheden verholpen in Oracle AnalyticsNL2025-10-23csaf · ncsc_nlNL
Oracle heeft meerdere kwetsbaarheden verholpen in Oracle Analytics producten.
- WID-SEC-W-2025-0316OpenSSL: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2025-02-11csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in OpenSSL ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
- WID-SEC-W-2025-0580IBM License Metric Tool: Mehrere SchwachstellenDeutsch2025-03-17csaf · cert_bundDE
Ein entfernter anonymer oder lokaler Angreifer kann mehrere Schwachstellen im IBM License Metric Tool ausnutzen, um Daten (Protokolldateien) zu manipulieren, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder SSRF-Angriffe durchzuführen.
- WID-SEC-W-2025-0823Oracle Communications: Mehrere SchwachstellenDeutsch2025-04-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2025-1559Oracle Communications: Mehrere SchwachstellenDeutsch2025-07-15csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- WID-SEC-W-2025-1850Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffDeutsch2025-08-14csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- GHSA-79v4-65xg-pq4gVulnerable OpenSSL included in cryptography wheels2025-02-11ghsa · osvUS
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 42.0.0-44.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20250211.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
- PYSEC-2026-1284Vulnerable OpenSSL included in cryptography wheels2026-07-07vendor · osvUS
pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 42.0.0-44.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20250211.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.
also known as (7)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (20)
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2025/02/11/3cnnvd
- https://access.redhat.com/security/cve/cve-2024-12797cnnvd
- https://github.com/openssl/openssl/commit/738d4f9fdeaad57660dcba50a619fafced3fd5e9cnnvd
- https://github.com/openssl/openssl/commit/798779d43494549b611233f92652f0da5328fbe7cnnvd
- https://github.com/openssl/openssl/commit/87ebd203feffcf92ad5889df92f90bb0ee10a699cnnvd
- https://openssl-library.org/news/secadv/20250211.txtcnnvd
- https://www.oracle.com/security-alerts/cpuapr2025.htmlcnnvd
- https://www.oracle.com/security-alerts/cpujul2025.htmlcnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan