6.3

CVE-2024-12797: openssl Missing Report of Error Condition

CVSS: 6.3v3.1MediumDeferred
AliasesALPINE-CVE-2024-12797GHSA-79v4-65xg-pq4gPYSEC-2026-1284
Published 11-02-2025Last modified 18-02-2025
Open JSON

Vulnerability summary

CVE-2024-12797 is a medium (CVSS 6.3) Missing Report of Error Condition vulnerability in openssl. EPSS estimates a 2.53% chance of exploitation in the next 30 days, higher than 84.6% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
2.53%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 17
SUSE-SU-2025:02042-1CGA-257F-FWPM-CRG7CGA-3VFJ-9857-37Q6CGA-5C5C-P672-QF7RCGA-6FW6-FXV7-M2Q7CGA-6P47-PJQC-C2HG

Timeline

  1. 11-02-2025
    PublishedVulnerability first disclosed.
  2. 18-02-2025
    Last modifiedVulnerability information updated.

Description

Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys may be vulnerable to man-in-middle attacks when server authentication failure is not detected by clients. RPKs are disabled by default in both TLS clients and TLS servers. The issue only arises when TLS clients explicitly enable RPK use by the server, and the server, likewise, enables sending of an RPK instead of an X.509 certificate chain. The affected clients are those that then rely on the handshake to fail when the server's RPK fails to match one of the expected public keys, by setting the verification mode to SSL_VERIFY_PEER. Clients that enable server-side raw public keys can still find out that raw public key verification failed by calling SSL_get_verify_result(), and those that do, and take appropriate action, are not affected. This issue was introduced in the initial implementation of RPK support in OpenSSL 3.2. The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

CVSS metrics

8 scores · 8 sources · 1 version

EPSS trend

Probability

2.53%

Chance of exploitation in the next 30 days

Percentile

85%

Versus all other CVEs

30-day change

0.00 pp

From 2.53% on 19-09-2026

19-09-202619-10-2026
EPSS score
2.53%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard69 products
  • airflow< 2.10.5-r1
  • airflow-bitnami-compat< 2.10.5-r1
  • airflow-core-3< 3.1.1-r1
  • airflow-core-3-compat< 3.1.1-r1
  • airflow-core-3-oci-entrypoint< 3.1.1-r1
Wolfi36 products
  • airflow< 2.10.5-r1
  • airflow-bitnami-compat< 2.10.5-r1
  • az< 2.69.0-r1
  • az-iamguarded-compat< 2.69.0-r1
  • ggshield< 1.37.0-r0
Redhat7 products
  • openssl< 1:3.2.2-16.el10 | < 1:3.2.2-6.el9_5.1
  • openssl-debuginfo< 1:3.2.2-16.el10 | < 1:3.2.2-6.el9_5.1
  • openssl-debugsource< 1:3.2.2-16.el10 | < 1:3.2.2-6.el9_5.1
  • openssl-devel< 1:3.2.2-16.el10 | < 1:3.2.2-6.el9_5.1
  • openssl-libs< 1:3.2.2-16.el10 | < 1:3.2.2-6.el9_5.1
Alpine1 product
  • openssl< 3.3.3-r0
Debian1 product
  • openssl< 3.4.1-1
Openssl1 product
  • openssl≥ 3.4.0, < 3.4.1 | ≥ 3.3.0, < 3.3.3 | ≥ 3.2.0, < 3.2.4
Opensuse1 product
  • openssl-3&distro=openSUSE Tumbleweed< 3.2.4-1.1
PyPI1 product
  • cryptography≥ 42.0.0, < 44.0.1
Ubuntu1 product
  • openssl< 3.4.1-1ubuntu1

9 vendors · 118 products

References

34 links
Show all 34 references