cbcvebase.
CVE-2024-6119
published 2024-09-03

CVE-2024-6119: Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address…

PriorityP359high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
66.58%
99.2th percentile
Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of service. Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address when comparing the expected name with an `otherName` subject alternative name of an X.509 certificate. This may result in an exception that terminates the application program. Note that basic certificate chain validation (signatures, dates, ...) is not affected, the denial of service can occur only when the application also specifies an expected DNS name, Email address or IP address. TLS servers rarely solicit client certificates, and even when they do, they generally don't perform a name check against a reference identifier (expected identity), but rather extract the presented identity after checking the certificate chain. So TLS servers are generally not affected and the severity of the issue is Moderate. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

Affected

48 ranges· showing 25
VendorProductVersion rangeFixed in
debianopenssl< openssl 3.0.14-1~deb12u2 (bookworm)openssl 3.0.14-1~deb12u2 (bookworm)
msrcazl3_cloud-hypervisor-cvm_38.0.72.2-2_on_azure_linux_3.0
msrcazl3_cloud-hypervisor-cvm_41.0.79-1_on_azure_linux_3.0
msrcazl3_edk2_20240524git3e722403cd16-3_on_azure_linux_3.0
msrcazl3_edk2_20240524git3e722403cd16-8_on_azure_linux_3.0
msrcazl3_openssl_3.3.0-2_on_azure_linux_3.0
msrcazl3_openssl_3.3.2-1_on_azure_linux_3.0
msrcazl3_qemu_8.2.0-16_on_azure_linux_3.0
msrcazure_linux_3.0_arm
msrcazure_linux_3.0_x64
msrccbl2_cloud-hypervisor-cvm_38.0.72.2-1_on_cbl_mariner_2.0
msrccbl2_cloud-hypervisor-cvm_38.0.72.2-2_on_cbl_mariner_2.0
msrccbl2_hvloader_1.0.1-5_on_cbl_mariner_2.0
msrccbl_mariner_2.0_arm
msrccbl_mariner_2.0_x64
netappontap_tools
opensslopenssl>= 0 < 3.0.15-r03.0.15-r0
opensslopenssl>= 0 < 3.1.7-r03.1.7-r0
opensslopenssl>= 0 < 3.1.7-r03.1.7-r0
opensslopenssl>= 0 < 3.3.2-r03.3.2-r0
opensslopenssl>= 0 < 3.3.2-r03.3.2-r0
opensslopenssl>= 0 < 3.3.2-r03.3.2-r0
opensslopenssl>= 0 < 3.3.2-r03.3.2-r0
opensslopenssl>= 0 < 3.0.14-1~deb12u23.0.14-1~deb12u2
opensslopenssl>= 0 < 3.3.2-13.3.2-1

Detection & IOCsextracted from sources · hover to see the quote

  • Trigger condition: DoS occurs only when an application performs certificate name checks AND specifies an expected DNS name, Email address, or IP address while encountering an `otherName` subject alternative name in an X.509 certificate.
  • The vulnerable code path is in X.509 `otherName` SAN comparison logic — monitor for abnormal process termination in TLS clients performing certificate name validation against certificates containing `otherName` SANs.
  • TLS servers are generally not affected; focus detection and patching efforts on TLS client applications that validate server certificate names.
  • FIPS module builds of OpenSSL (versions 3.0, 3.1, 3.2, 3.3) are NOT affected — scope detection/patching to non-FIPS OpenSSL deployments.
  • FreeBSD 14.x systems using the bundled OpenSSL are affected; patch was committed 2024-09-03. Check for unpatched FreeBSD 14.x hosts running TLS client applications.
  • ·Only non-FIPS OpenSSL builds are vulnerable; FIPS module builds across all affected version lines (3.0–3.3) are explicitly not affected.
  • ·Basic certificate chain validation (signatures, dates, etc.) is unaffected; the vulnerability is isolated to the name-check comparison code path involving `otherName` SANs.
  • ·No workaround is available for affected systems; patching is the only remediation.

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
osv7.5HIGH
vendor_debian7.5HIGH
vendor_msrc7.5HIGH
vendor_redhat7.5HIGH
vendor_ubuntu7.4HIGH
vendor_oracle5.9HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.