CVE-2024-12797 — Missing Report of Error Condition in Openssl

CWE-392 — Missing Report of Error ConditionCWE-295 — Improper Certificate ValidationCWE-1395 — Dependency on Vulnerable Third-Party Component15 documents10 sources
Severity
6.3MEDIUMNVD
EPSS
0.8%
top 26.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
21
OpensslCryptography.io CryptographyDebian Openssl+18 more
Timeline
PublishedFeb 11
Latest updateApr 10

Description

Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode is set. Impact summary: TLS and DTLS connections using raw public keys may be vulnerable to man-in-middle attacks when server authentication failure is not detected by clients. RPKs are disabled by default in both TLS clients and TLS servers. The issue only arises when…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.4

Affected Packages24 packages

▶debiandebian/openssl< openssl 3.4.1-1 (forky)
▶CVEListV5openssl/openssl3.4.0 — 3.4.1+2
▶Alpineopenssl/openssl< 3.3.3-r0+3
▶Debianopenssl/openssl< 3.4.1-1+1
▶Ubuntuopenssl/openssl< 3.3.1-2ubuntu2.1

🔴Vulnerability Details

6
VulDB
OpenSSL up to 3.4.0 RFC7250 Raw Public Key error condition (Nessus ID 216104 / WID-SEC-2025-1850)↗2026-04-10
▶
OSV
CVE-2024-12797: Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because↗2025-02-11
▶
OSV
CVE-2024-12797: Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a server may fail to notice that the server was not authenticated, because↗2025-02-11
▶
GHSA
Vulnerable OpenSSL included in cryptography wheels↗2025-02-11
▶
OSV
openssl vulnerabilities↗2025-02-11
▶

📋Vendor Advisories

8
Oracle
Oracle Oracle Analytics Risk Matrix: Analytics Server (Cryptography) — CVE-2024-12797↗2025-10-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Alarms, KPI, and Measurements (Cryptography) — CVE-2024-12797↗2025-07-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Configuration (Cryptography) — CVE-2024-12797↗2025-04-15
▶
Ubuntu
OpenSSL vulnerabilities↗2025-02-11
▶
Red Hat
openssl: RFC7250 handshakes with unauthenticated servers don't abort as expected↗2025-02-11
▶
CVE-2024-12797 — Missing Report of Error Condition | cvebase