OpenSSL: Missing Report of Error Condition
CVE-2024-12797 is a high-severity missing report of error condition vulnerability in OpenSSL, with a CVSS 3.1 base score of 7.4 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 3.4.1, 3.3.3, 3.2.4 as the first without the flaw, so updating OpenSSL to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 1.86% chance of exploitation within 30 days, higher than 80% of scored CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update OpenSSL to 3.4.1 or 3.3.3 or 3.2.4, whichever matches your release line, or a later version.
- Read the advisory on openssl-library.org for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| OpenSSL | OpenSSL | 3.4.0 up to, but not including, 3.4.1; 3.3.0 up to, but not including, 3.3.3; 3.2.0 up to, but not including, 3.2.4 | 3.4.1, 3.3.3, 3.2.4 |
| NetApp | Snapmanager | Not specified in the record | Not stated |
| NetApp | Brocade Fabric Operating System | Not specified in the record | Not stated |
| NetApp | H300s Firmware | Not specified in the record | Not stated |
| NetApp | H500s Firmware | Not specified in the record | Not stated |
| NetApp | H700s Firmware | Not specified in the record | Not stated |
| NetApp | H410s Firmware | Not specified in the record | Not stated |
| NetApp | H410c Firmware | Not specified in the record | Not stated |
| NetApp | H610c Firmware | Not specified in the record | Not stated |
| NetApp | H610s Firmware | Not specified in the record | Not stated |
| NetApp | H615c Firmware | Not specified in the record | Not stated |
| NetApp | Bootstrap OS | Not specified in the record | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- HighSuccess depends on conditions outside the attacker's control.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- NoneAvailability is not affected.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N. Scored by CISA (ADP).
Official description
Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys may be vulnerable to man-in-middle attacks when server authentication failure is not detected by clients. RPKs are disabled by default in both TLS clients and TLS servers. The issue only arises when TLS clients explicitly enable RPK use by the server, and the server, likewise, enables sending of an RPK instead of an X.509 certificate chain. The affected clients are those that then rely on the handshake to fail when the server's RPK fails to match one of the expected public keys, by setting the verification mode to SSL_VERIFY_PEER. Clients that enable server-side raw public keys can still find out that raw public key verification failed by calling SSL_get_verify_result(), and those that do, and take appropriate action, are not affected. This issue was introduced in the initial implementation of RPK support in OpenSSL 3.2. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Missing Report of Error Condition
The product encounters an error but does not provide a status code or return value to indicate that an error has occurred.
More Missing Report of Error Condition vulnerabilities (CWE-392)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
Third-party and government advisories
- openwall.com/lists/oss-security/2025/02/11/3Mailing List, Third Party Advisory
- openwall.com/lists/oss-security/2025/02/11/4Mailing List, Third Party Advisory
- security.netapp.com/advisory/ntap-20250214-0001/Third Party Advisory
Other vulnerabilities in OpenSSL
- 7.5 High severity
- 7.5 High severity
- 8.2 High severity
- 7.5 High severity
- 7.5 High severity
- 9.1 Critical severity
Spotted an error? Tell us.