OESA-2024-1147

See a problem?
Please try reporting it to the source first.

Source

https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1147

Import Source

https://repo.openeuler.org/security/data/osv/OESA-2024-1147.json

JSON Data

https://api.test.osv.dev/v1/vulns/OESA-2024-1147

Upstream

CVE-2024-0727

Published

2024-02-08T11:06:56Z

Modified

2025-08-12T05:24:53.346752Z

Summary

openssl security update

Details

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols.

Security Fix(es):

Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack

Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly.

A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue.

OpenSSL APIs that are vulnerable to this are: PKCS12parse(), PKCS12unpackp7data(), PKCS12unpackp7encdata(), PKCS12unpackauthsafes() and PKCS12newpass().

We have also fixed a similar issue in SMIMEwritePKCS7(). However since this function is related to writing data we do not consider it security significant.

The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.(CVE-2024-0727)

Database specific

{
    "severity": "Medium"
}

References

Affected packages

openEuler:20.03-LTS-SP1 / openssl

Package

Name: openssl
Purl: pkg:rpm/openEuler/openssl&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.1f-32.oe1

Ecosystem specific

{
    "src": [
        "openssl-1.1.1f-32.oe1.src.rpm"
    ],
    "noarch": [
        "openssl-help-1.1.1f-32.oe1.noarch.rpm"
    ],
    "x86_64": [
        "openssl-debuginfo-1.1.1f-32.oe1.x86_64.rpm",
        "openssl-1.1.1f-32.oe1.x86_64.rpm",
        "openssl-devel-1.1.1f-32.oe1.x86_64.rpm",
        "openssl-libs-1.1.1f-32.oe1.x86_64.rpm",
        "openssl-debugsource-1.1.1f-32.oe1.x86_64.rpm"
    ],
    "aarch64": [
        "openssl-devel-1.1.1f-32.oe1.aarch64.rpm",
        "openssl-debuginfo-1.1.1f-32.oe1.aarch64.rpm",
        "openssl-libs-1.1.1f-32.oe1.aarch64.rpm",
        "openssl-debugsource-1.1.1f-32.oe1.aarch64.rpm",
        "openssl-1.1.1f-32.oe1.aarch64.rpm"
    ]
}

openEuler:20.03-LTS-SP4 / openssl

Package

Name: openssl
Purl: pkg:rpm/openEuler/openssl&distro=openEuler-20.03-LTS-SP4

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.1f-32.oe2003sp4

Ecosystem specific

{
    "src": [
        "openssl-1.1.1f-32.oe2003sp4.src.rpm"
    ],
    "noarch": [
        "openssl-help-1.1.1f-32.oe2003sp4.noarch.rpm"
    ],
    "x86_64": [
        "openssl-libs-1.1.1f-32.oe2003sp4.x86_64.rpm",
        "openssl-1.1.1f-32.oe2003sp4.x86_64.rpm",
        "openssl-devel-1.1.1f-32.oe2003sp4.x86_64.rpm",
        "openssl-debuginfo-1.1.1f-32.oe2003sp4.x86_64.rpm",
        "openssl-debugsource-1.1.1f-32.oe2003sp4.x86_64.rpm"
    ],
    "aarch64": [
        "openssl-debugsource-1.1.1f-32.oe2003sp4.aarch64.rpm",
        "openssl-devel-1.1.1f-32.oe2003sp4.aarch64.rpm",
        "openssl-1.1.1f-32.oe2003sp4.aarch64.rpm",
        "openssl-libs-1.1.1f-32.oe2003sp4.aarch64.rpm",
        "openssl-debuginfo-1.1.1f-32.oe2003sp4.aarch64.rpm"
    ]
}

openEuler:22.03-LTS / openssl

Package

Name: openssl
Purl: pkg:rpm/openEuler/openssl&distro=openEuler-22.03-LTS

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.1wa-4.oe2203sp3

Ecosystem specific

{
    "src": [
        "openssl-1.1.1m-26.oe2203.src.rpm",
        "openssl-1.1.1m-32.oe2203sp1.src.rpm",
        "openssl-1.1.1m-33.oe2203sp2.src.rpm",
        "openssl-1.1.1wa-4.oe2203sp3.src.rpm"
    ],
    "noarch": [
        "openssl-help-1.1.1m-26.oe2203.noarch.rpm",
        "openssl-help-1.1.1m-32.oe2203sp1.noarch.rpm",
        "openssl-help-1.1.1m-33.oe2203sp2.noarch.rpm",
        "openssl-help-1.1.1wa-4.oe2203sp3.noarch.rpm"
    ],
    "x86_64": [
        "openssl-debugsource-1.1.1m-26.oe2203.x86_64.rpm",
        "openssl-libs-1.1.1m-26.oe2203.x86_64.rpm",
        "openssl-perl-1.1.1m-26.oe2203.x86_64.rpm",
        "openssl-1.1.1m-26.oe2203.x86_64.rpm",
        "openssl-devel-1.1.1m-26.oe2203.x86_64.rpm",
        "openssl-debuginfo-1.1.1m-26.oe2203.x86_64.rpm",
        "openssl-debuginfo-1.1.1m-32.oe2203sp1.x86_64.rpm",
        "openssl-debugsource-1.1.1m-32.oe2203sp1.x86_64.rpm",
        "openssl-libs-1.1.1m-32.oe2203sp1.x86_64.rpm",
        "openssl-perl-1.1.1m-32.oe2203sp1.x86_64.rpm",
        "openssl-1.1.1m-32.oe2203sp1.x86_64.rpm",
        "openssl-devel-1.1.1m-32.oe2203sp1.x86_64.rpm",
        "openssl-debuginfo-1.1.1m-33.oe2203sp2.x86_64.rpm",
        "openssl-perl-1.1.1m-33.oe2203sp2.x86_64.rpm",
        "openssl-debugsource-1.1.1m-33.oe2203sp2.x86_64.rpm",
        "openssl-1.1.1m-33.oe2203sp2.x86_64.rpm",
        "openssl-devel-1.1.1m-33.oe2203sp2.x86_64.rpm",
        "openssl-libs-1.1.1m-33.oe2203sp2.x86_64.rpm",
        "openssl-devel-1.1.1wa-4.oe2203sp3.x86_64.rpm",
        "openssl-debugsource-1.1.1wa-4.oe2203sp3.x86_64.rpm",
        "openssl-perl-1.1.1wa-4.oe2203sp3.x86_64.rpm",
        "openssl-debuginfo-1.1.1wa-4.oe2203sp3.x86_64.rpm",
        "openssl-libs-1.1.1wa-4.oe2203sp3.x86_64.rpm",
        "openssl-1.1.1wa-4.oe2203sp3.x86_64.rpm"
    ],
    "aarch64": [
        "openssl-1.1.1m-26.oe2203.aarch64.rpm",
        "openssl-debugsource-1.1.1m-26.oe2203.aarch64.rpm",
        "openssl-libs-1.1.1m-26.oe2203.aarch64.rpm",
        "openssl-devel-1.1.1m-26.oe2203.aarch64.rpm",
        "openssl-debuginfo-1.1.1m-26.oe2203.aarch64.rpm",
        "openssl-perl-1.1.1m-26.oe2203.aarch64.rpm",
        "openssl-perl-1.1.1m-32.oe2203sp1.aarch64.rpm",
        "openssl-debuginfo-1.1.1m-32.oe2203sp1.aarch64.rpm",
        "openssl-1.1.1m-32.oe2203sp1.aarch64.rpm",
        "openssl-debugsource-1.1.1m-32.oe2203sp1.aarch64.rpm",
        "openssl-devel-1.1.1m-32.oe2203sp1.aarch64.rpm",
        "openssl-libs-1.1.1m-32.oe2203sp1.aarch64.rpm",
        "openssl-debugsource-1.1.1m-33.oe2203sp2.aarch64.rpm",
        "openssl-1.1.1m-33.oe2203sp2.aarch64.rpm",
        "openssl-devel-1.1.1m-33.oe2203sp2.aarch64.rpm",
        "openssl-debuginfo-1.1.1m-33.oe2203sp2.aarch64.rpm",
        "openssl-libs-1.1.1m-33.oe2203sp2.aarch64.rpm",
        "openssl-perl-1.1.1m-33.oe2203sp2.aarch64.rpm",
        "openssl-debuginfo-1.1.1wa-4.oe2203sp3.aarch64.rpm",
        "openssl-debugsource-1.1.1wa-4.oe2203sp3.aarch64.rpm",
        "openssl-devel-1.1.1wa-4.oe2203sp3.aarch64.rpm",
        "openssl-1.1.1wa-4.oe2203sp3.aarch64.rpm",
        "openssl-perl-1.1.1wa-4.oe2203sp3.aarch64.rpm",
        "openssl-libs-1.1.1wa-4.oe2203sp3.aarch64.rpm"
    ]
}

openEuler:22.03-LTS-SP1 / openssl

Package

Name: openssl
Purl: pkg:rpm/openEuler/openssl&distro=openEuler-22.03-LTS-SP1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.1m-32.oe2203sp1

Ecosystem specific

{
    "src": [
        "openssl-1.1.1m-32.oe2203sp1.src.rpm"
    ],
    "noarch": [
        "openssl-help-1.1.1m-32.oe2203sp1.noarch.rpm"
    ],
    "x86_64": [
        "openssl-debuginfo-1.1.1m-32.oe2203sp1.x86_64.rpm",
        "openssl-debugsource-1.1.1m-32.oe2203sp1.x86_64.rpm",
        "openssl-libs-1.1.1m-32.oe2203sp1.x86_64.rpm",
        "openssl-perl-1.1.1m-32.oe2203sp1.x86_64.rpm",
        "openssl-1.1.1m-32.oe2203sp1.x86_64.rpm",
        "openssl-devel-1.1.1m-32.oe2203sp1.x86_64.rpm"
    ],
    "aarch64": [
        "openssl-perl-1.1.1m-32.oe2203sp1.aarch64.rpm",
        "openssl-debuginfo-1.1.1m-32.oe2203sp1.aarch64.rpm",
        "openssl-1.1.1m-32.oe2203sp1.aarch64.rpm",
        "openssl-debugsource-1.1.1m-32.oe2203sp1.aarch64.rpm",
        "openssl-devel-1.1.1m-32.oe2203sp1.aarch64.rpm",
        "openssl-libs-1.1.1m-32.oe2203sp1.aarch64.rpm"
    ]
}

openEuler:22.03-LTS-SP2 / openssl

Package

Name: openssl
Purl: pkg:rpm/openEuler/openssl&distro=openEuler-22.03-LTS-SP2

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.1m-33.oe2203sp2

Ecosystem specific

{
    "src": [
        "openssl-1.1.1m-33.oe2203sp2.src.rpm"
    ],
    "noarch": [
        "openssl-help-1.1.1m-33.oe2203sp2.noarch.rpm"
    ],
    "x86_64": [
        "openssl-debuginfo-1.1.1m-33.oe2203sp2.x86_64.rpm",
        "openssl-perl-1.1.1m-33.oe2203sp2.x86_64.rpm",
        "openssl-debugsource-1.1.1m-33.oe2203sp2.x86_64.rpm",
        "openssl-1.1.1m-33.oe2203sp2.x86_64.rpm",
        "openssl-devel-1.1.1m-33.oe2203sp2.x86_64.rpm",
        "openssl-libs-1.1.1m-33.oe2203sp2.x86_64.rpm"
    ],
    "aarch64": [
        "openssl-debugsource-1.1.1m-33.oe2203sp2.aarch64.rpm",
        "openssl-1.1.1m-33.oe2203sp2.aarch64.rpm",
        "openssl-devel-1.1.1m-33.oe2203sp2.aarch64.rpm",
        "openssl-debuginfo-1.1.1m-33.oe2203sp2.aarch64.rpm",
        "openssl-libs-1.1.1m-33.oe2203sp2.aarch64.rpm",
        "openssl-perl-1.1.1m-33.oe2203sp2.aarch64.rpm"
    ]
}

openEuler:22.03-LTS-SP3 / openssl

Package

Name: openssl
Purl: pkg:rpm/openEuler/openssl&distro=openEuler-22.03-LTS-SP3

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.1.1wa-4.oe2203sp3

Ecosystem specific

{
    "src": [
        "openssl-1.1.1wa-4.oe2203sp3.src.rpm"
    ],
    "noarch": [
        "openssl-help-1.1.1wa-4.oe2203sp3.noarch.rpm"
    ],
    "x86_64": [
        "openssl-devel-1.1.1wa-4.oe2203sp3.x86_64.rpm",
        "openssl-debugsource-1.1.1wa-4.oe2203sp3.x86_64.rpm",
        "openssl-perl-1.1.1wa-4.oe2203sp3.x86_64.rpm",
        "openssl-debuginfo-1.1.1wa-4.oe2203sp3.x86_64.rpm",
        "openssl-libs-1.1.1wa-4.oe2203sp3.x86_64.rpm",
        "openssl-1.1.1wa-4.oe2203sp3.x86_64.rpm"
    ],
    "aarch64": [
        "openssl-debuginfo-1.1.1wa-4.oe2203sp3.aarch64.rpm",
        "openssl-debugsource-1.1.1wa-4.oe2203sp3.aarch64.rpm",
        "openssl-devel-1.1.1wa-4.oe2203sp3.aarch64.rpm",
        "openssl-1.1.1wa-4.oe2203sp3.aarch64.rpm",
        "openssl-perl-1.1.1wa-4.oe2203sp3.aarch64.rpm",
        "openssl-libs-1.1.1wa-4.oe2203sp3.aarch64.rpm"
    ]
}