# CVE-2024-0727: libssl3t64: Issue summary: Processing a maliciously formatted PKCS12 file may leadOpenSSLto crash leading to a potential Denial o...

CVE-2024-0727 is fixed in 31 products on 1 platform, first by libssl3t64 3.0.10-1ubuntu4, released January 15, 2024. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2024-0727
- Priority: Routine
- CVSS: 5.5 (Low)
- EPSS: 0.0319
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jan 26, 2024

## Description

Issue summary: Processing a maliciously formatted PKCS12 file may leadOpenSSLto crash leading to a potential Denial of Service attackImpact summary: Applications loading files in the PKCS12 format fromuntrustedsources might terminate abruptly.A file in PKCS12 format can contain certificates and keys and may come fromanuntrusted source. The PKCS12 specification allows certain fields to beNULL, butOpenSSL does not correctly check for this case. This can lead to a NULLpointerdereference that results in OpenSSL crashing. If an application processesPKCS12files from an untrusted source using the OpenSSL APIs then that applicationwillbe vulnerable to this issue.OpenSSL APIs that are vulnerable to this are: PKCS12_parse(),PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(),PKCS12_unpack_authsafes()and PKCS12_newpass().We have also fixed a similar issue in SMIME_write_PKCS7(). However sincethisfunction is related to writing data we do not consider it securitysignificant.The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | edk2 rocky 9 | 0:20240524-6.el9_5.3 | [RLSA-2024:9088](https://patchblox.com/security/data/fix/linux/rlsa-2024-9088.md) | Mar 17, 2025 |
| Linux | edk2-aarch64 RHEL 9 | 0:20240524-6.el9_5 | [RHSA-2024:9088](https://patchblox.com/security/data/fix/linux/rhsa-2024-9088.md) | Nov 12, 2024 |
| Linux | edk2-aarch64 almalinux 9 | 20240524-6.el9_5 | [ALSA-2024:9088](https://patchblox.com/security/data/fix/linux/alsa-2024-9088.md) | Nov 12, 2024 |
| Linux | edk2-aarch64 ol 9 | 0:20240524-6.0.1.el9_5 | [ELSA-2024-9088](https://patchblox.com/security/data/fix/linux/elsa-2024-9088.md) | Nov 14, 2024 |
| Linux | edk2-ovmf RHEL 9 | 0:20240524-6.el9_5 | [RHSA-2024:9088](https://patchblox.com/security/data/fix/linux/rhsa-2024-9088.md) | Nov 12, 2024 |
| Linux | edk2-ovmf almalinux 9 | 20240524-6.el9_5 | [ALSA-2024:9088](https://patchblox.com/security/data/fix/linux/alsa-2024-9088.md) | Nov 12, 2024 |
| Linux | edk2-ovmf ol 9 | 0:20240524-6.0.1.el9_5 | [ELSA-2024-9088](https://patchblox.com/security/data/fix/linux/elsa-2024-9088.md) | Nov 14, 2024 |
| Linux | edk2-tools RHEL 9 | 0:20240524-6.el9_5 | [RHSA-2024:9088](https://patchblox.com/security/data/fix/linux/rhsa-2024-9088.md) | Nov 12, 2024 |
| Linux | edk2-tools almalinux 9 | 20240524-6.el9_5 | [ALSA-2024:9088](https://patchblox.com/security/data/fix/linux/alsa-2024-9088.md) | Nov 12, 2024 |
| Linux | edk2-tools ol 9 | 0:20240524-6.0.1.el9_5 | [ELSA-2024-9088](https://patchblox.com/security/data/fix/linux/elsa-2024-9088.md) | Nov 14, 2024 |
| Linux | edk2-tools-doc RHEL 9 | 0:20240524-6.el9_5 | [RHSA-2024:9088](https://patchblox.com/security/data/fix/linux/rhsa-2024-9088.md) | Nov 12, 2024 |
| Linux | edk2-tools-doc almalinux 9 | 20240524-6.el9_5 | [ALSA-2024:9088](https://patchblox.com/security/data/fix/linux/alsa-2024-9088.md) | Nov 12, 2024 |
| Linux | edk2-tools-doc ol 9 | 0:20240524-6.0.1.el9_5 | [ELSA-2024-9088](https://patchblox.com/security/data/fix/linux/elsa-2024-9088.md) | Nov 14, 2024 |
| Linux | efi-shell-aa64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [efi-shell-aa64 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-aa64-2024.02-2ubuntu0.6.md) | Aug 12, 2025 |
| Linux | efi-shell-arm Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [efi-shell-arm 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-arm-2024.02-2ubuntu0.6.md) | Aug 12, 2025 |
| Linux | efi-shell-ia32 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [efi-shell-ia32 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-ia32-2024.02-2ubuntu0.6.md) | Aug 12, 2025 |
| Linux | efi-shell-riscv64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [efi-shell-riscv64 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-riscv64-2024.02-2ubuntu0.6.md) | Aug 12, 2025 |
| Linux | efi-shell-x64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [efi-shell-x64 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-efi-shell-x64-2024.02-2ubuntu0.6.md) | Aug 12, 2025 |
| Linux | libssl1.0.0 Ubuntu 18.04.6 LTS (bionic) | 1.0.2n-1ubuntu5.13+esm1 | [libssl1.0.0 1.0.2n-1ubuntu5.13+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libssl1.0.0-1.0.2n-1ubuntu5.13-esm1.md) | Jan 26, 2024 |
| Linux | libssl1.1 Ubuntu 18.04.6 LTS (bionic) | 1.1.1-1ubuntu2.1~18.04.23+esm4 | [libssl1.1 1.1.1-1ubuntu2.1~18.04.23+esm4](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libssl1.1-1.1.1-1ubuntu2.1-18.04.23-esm4.md) | Jan 26, 2024 |
| Linux | libssl1.1 Ubuntu 20.04 LTS (focal) | 1.1.1f-1ubuntu2.21 | [libssl1.1 1.1.1f-1ubuntu2.21](https://patchblox.com/security/data/fix/linux/ubuntu-focal-libssl1.1-1.1.1f-1ubuntu2.21.md) | Jan 26, 2024 |
| Linux | libssl3 Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.14 | [libssl3 3.0.2-0ubuntu1.14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libssl3-3.0.2-0ubuntu1.14.md) | Jan 26, 2024 |
| Linux | libssl3 Ubuntu 24.04.5 LTS (noble) | 3.0.10-1ubuntu4 | [libssl3 3.0.10-1ubuntu4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-libssl3-3.0.10-1ubuntu4.md) | Jan 26, 2024 |
| Linux | libssl3t64 Ubuntu 24.10 (oracular) | 3.0.10-1ubuntu4 | [libssl3t64 3.0.10-1ubuntu4](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libssl3t64-3.0.10-1ubuntu4.md) | Jan 15, 2024 |
| Linux | libssl3t64 Ubuntu 25.04 (plucky) | 3.0.10-1ubuntu4 | [libssl3t64 3.0.10-1ubuntu4](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libssl3t64-3.0.10-1ubuntu4.md) | Jan 15, 2024 |
| Linux | openssl Debian 12.15 (bookworm) | 3.0.13-1~deb12u1 | [DEBIAN-CVE-2024-0727](https://patchblox.com/security/data/fix/linux/debian-cve-2024-0727.md) | Jan 26, 2024 |
| Linux | openssl Debian 13.5 (trixie) | 3.1.5-1 | [DEBIAN-CVE-2024-0727](https://patchblox.com/security/data/fix/linux/debian-cve-2024-0727.md) | Jan 26, 2024 |
| Linux | openssl Debian 14 | 3.1.5-1 | [DEBIAN-CVE-2024-0727](https://patchblox.com/security/data/fix/linux/debian-cve-2024-0727.md) | Jan 26, 2024 |
| Linux | openssl RHEL 9 | 1:3.0.7-27.el9 | [RHSA-2024:2447](https://patchblox.com/security/data/fix/linux/rhsa-2024-2447.md) | Apr 30, 2024 |
| Linux | openssl Ubuntu 18.04.6 LTS (bionic) | 1.1.1-1ubuntu2.1~18.04.23+esm4 | [openssl 1.1.1-1ubuntu2.1~18.04.23+esm4](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openssl-1.1.1-1ubuntu2.1-18.04.23-esm4.md) | Jan 26, 2024 |
| Linux | openssl Ubuntu 20.04 LTS (focal) | 1.1.1f-1ubuntu2.21 | [openssl 1.1.1f-1ubuntu2.21](https://patchblox.com/security/data/fix/linux/ubuntu-focal-openssl-1.1.1f-1ubuntu2.21.md) | Jan 26, 2024 |
| Linux | openssl Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.14 | [openssl 3.0.2-0ubuntu1.14](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-openssl-3.0.2-0ubuntu1.14.md) | Jan 26, 2024 |
| Linux | openssl Ubuntu 24.04.5 LTS (noble) | 3.0.10-1ubuntu4 | [openssl 3.0.10-1ubuntu4](https://patchblox.com/security/data/fix/linux/ubuntu-noble-openssl-3.0.10-1ubuntu4.md) | Jan 26, 2024 |
| Linux | openssl Ubuntu 24.10 (oracular) | 3.0.10-1ubuntu4 | [openssl 3.0.10-1ubuntu4](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-openssl-3.0.10-1ubuntu4.md) | Jan 15, 2024 |
| Linux | openssl Ubuntu 25.04 (plucky) | 3.0.10-1ubuntu4 | [openssl 3.0.10-1ubuntu4](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-openssl-3.0.10-1ubuntu4.md) | Jan 15, 2024 |
| Linux | openssl almalinux 9 | 1:3.0.7-27.el9 | [ALSA-2024:2447](https://patchblox.com/security/data/fix/linux/alsa-2024-2447.md) | Apr 30, 2024 |
| Linux | openssl amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 |
| Linux | openssl ol 9 | 1:3.0.7-27.0.3.el9 | [ELSA-2024-2447](https://patchblox.com/security/data/fix/linux/elsa-2024-2447.md) | May 3, 2024 |
| Linux | openssl-debuginfo amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 |
| Linux | openssl-debugsource amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 |
| Linux | openssl-devel RHEL 9 | 1:3.0.7-27.el9 | [RHSA-2024:2447](https://patchblox.com/security/data/fix/linux/rhsa-2024-2447.md) | Apr 30, 2024 |
| Linux | openssl-devel almalinux 9 | 1:3.0.7-27.el9 | [ALSA-2024:2447](https://patchblox.com/security/data/fix/linux/alsa-2024-2447.md) | Apr 30, 2024 |
| Linux | openssl-devel amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 |
| Linux | openssl-devel ol 9 | 1:3.0.7-27.0.3.el9 | [ELSA-2024-2447](https://patchblox.com/security/data/fix/linux/elsa-2024-2447.md) | May 3, 2024 |
| Linux | openssl-fips-provider ol 9 | 0:3.0.7-2.0.1.el9 | [ELSA-2024-2447](https://patchblox.com/security/data/fix/linux/elsa-2024-2447.md) | May 3, 2024 |
| Linux | openssl-libs RHEL 9 | 1:3.0.7-27.el9 | [RHSA-2024:2447](https://patchblox.com/security/data/fix/linux/rhsa-2024-2447.md) | Apr 30, 2024 |
| Linux | openssl-libs almalinux 9 | 1:3.0.7-27.el9 | [ALSA-2024:2447](https://patchblox.com/security/data/fix/linux/alsa-2024-2447.md) | Apr 30, 2024 |
| Linux | openssl-libs amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 |
| Linux | openssl-libs ol 9 | 1:3.0.7-27.0.3.el9 | [ELSA-2024-2447](https://patchblox.com/security/data/fix/linux/elsa-2024-2447.md) | May 3, 2024 |
| Linux | openssl-libs-debuginfo amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 |
| Linux | openssl-perl RHEL 9 | 1:3.0.7-27.el9 | [RHSA-2024:2447](https://patchblox.com/security/data/fix/linux/rhsa-2024-2447.md) | Apr 30, 2024 |
| Linux | openssl-perl almalinux 9 | 1:3.0.7-27.el9 | [ALSA-2024:2447](https://patchblox.com/security/data/fix/linux/alsa-2024-2447.md) | Apr 30, 2024 |
| Linux | openssl-perl amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 |
| Linux | openssl-perl ol 9 | 1:3.0.7-27.0.3.el9 | [ELSA-2024-2447](https://patchblox.com/security/data/fix/linux/elsa-2024-2447.md) | May 3, 2024 |
| Linux | openssl-snapsafe-libs amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 |
| Linux | openssl-snapsafe-libs-debuginfo amzn 2023 | 1:3.0.8-1.amzn2023.0.11 | [ALAS2023-2024-520](https://patchblox.com/security/data/fix/linux/alas2023-2024-520.md) | Feb 15, 2024 |
| Linux | openssl1.0 Ubuntu 18.04.6 LTS (bionic) | 1.0.2n-1ubuntu5.13+esm1 | [openssl1.0 1.0.2n-1ubuntu5.13+esm1](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-openssl1.0-1.0.2n-1ubuntu5.13-esm1.md) | Jan 26, 2024 |
| Linux | ovmf Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.4 | [ovmf 2022.02-3ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-ovmf-2022.02-3ubuntu0.22.04.4.md) | Aug 12, 2025 |
| Linux | ovmf Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [ovmf 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ovmf-2024.02-2ubuntu0.6.md) | Aug 12, 2025 |
| Linux | ovmf-ia32 Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.4 | [ovmf-ia32 2022.02-3ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-ovmf-ia32-2022.02-3ubuntu0.22.04.4.md) | Aug 12, 2025 |
| Linux | ovmf-ia32 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [ovmf-ia32 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-ovmf-ia32-2024.02-2ubuntu0.6.md) | Aug 12, 2025 |
| Linux | qemu-efi Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.4 | [qemu-efi 2022.02-3ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-efi-2022.02-3ubuntu0.22.04.4.md) | Aug 12, 2025 |
| Linux | qemu-efi-aarch64 Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.4 | [qemu-efi-aarch64 2022.02-3ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-efi-aarch64-2022.02-3ubuntu0.22.04.4.md) | Aug 12, 2025 |
| Linux | qemu-efi-aarch64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [qemu-efi-aarch64 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-aarch64-2024.02-2ubuntu0.6.md) | Aug 12, 2025 |
| Linux | qemu-efi-arm Ubuntu 22.04.1 LTS (jammy) | 2022.02-3ubuntu0.22.04.4 | [qemu-efi-arm 2022.02-3ubuntu0.22.04.4](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-qemu-efi-arm-2022.02-3ubuntu0.22.04.4.md) | Aug 12, 2025 |
| Linux | qemu-efi-arm Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [qemu-efi-arm 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-arm-2024.02-2ubuntu0.6.md) | Aug 12, 2025 |
| Linux | qemu-efi-riscv64 Ubuntu 24.04.5 LTS (noble) | 2024.02-2ubuntu0.6 | [qemu-efi-riscv64 2024.02-2ubuntu0.6](https://patchblox.com/security/data/fix/linux/ubuntu-noble-qemu-efi-riscv64-2024.02-2ubuntu0.6.md) | Aug 12, 2025 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.