# CVE-2024-12797: libssl3t64: Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticateaserver may fail to notice that the server... CVE-2024-12797 is fixed in 7 products on 1 platform, first by libssl3t64 3.3.1-2ubuntu2.1, released February 11, 2025. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2024-12797 - Priority: High - CVSS: 7.4 (High) - EPSS: 0.0186 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Feb 11, 2025 ## Description Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticateaserver may fail to notice that the server was not authenticated, becausehandshakes don't abort as expected when the SSL_VERIFY_PEER verificationmodeis set.Impact summary: TLS and DTLS connections using raw public keys may bevulnerable to man-in-middle attacks when server authentication failure isnotdetected by clients.RPKs are disabled by default in both TLS clients and TLS servers. Theissueonly arises when TLS clients explicitly enable RPK use by the server, andtheserver, likewise, enables sending of an RPK instead of an X.509 certificatechain. The affected clients are those that then rely on the handshake tofail when the server's RPK fails to match one of the expected public keys,by setting the verification mode to SSL_VERIFY_PEER.Clients that enable server-side raw public keys can still find out that rawpublic key verification failed by calling SSL_get_verify_result(), andthosethat do, and take appropriate action, are not affected. This issue wasintroduced in the initial implementation of RPK support in OpenSSL 3.2.The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by thisissue. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libssl3t64 Ubuntu 24.10 (oracular) | 3.3.1-2ubuntu2.1 | [libssl3t64 3.3.1-2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-libssl3t64-3.3.1-2ubuntu2.1.md) | Feb 11, 2025 | | Linux | libssl3t64 Ubuntu 25.04 (plucky) | 3.4.1-1ubuntu1 | [libssl3t64 3.4.1-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-libssl3t64-3.4.1-1ubuntu1.md) | Feb 11, 2025 | | Linux | openssl Debian 13.5 (trixie) | 3.4.1-1 | [DEBIAN-CVE-2024-12797](https://patchblox.com/security/data/fix/linux/debian-cve-2024-12797.md) | Feb 11, 2025 | | Linux | openssl Debian 14 | 3.4.1-1 | [DEBIAN-CVE-2024-12797](https://patchblox.com/security/data/fix/linux/debian-cve-2024-12797.md) | Feb 11, 2025 | | Linux | openssl RHEL 10 | 3.2.2-16.el10 | [RHBA-2025:6314](https://patchblox.com/security/data/fix/linux/rhba-2025-6314.md) | Feb 11, 2025 | | Linux | openssl RHEL 9 | 1:3.2.2-6.el9_5.1 | [RHSA-2025:1330](https://patchblox.com/security/data/fix/linux/rhsa-2025-1330.md) | Feb 11, 2025 | | Linux | openssl Ubuntu 24.10 (oracular) | 3.3.1-2ubuntu2.1 | [openssl 3.3.1-2ubuntu2.1](https://patchblox.com/security/data/fix/linux/ubuntu-oracular-openssl-3.3.1-2ubuntu2.1.md) | Feb 11, 2025 | | Linux | openssl Ubuntu 25.04 (plucky) | 3.4.1-1ubuntu1 | [openssl 3.4.1-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-openssl-3.4.1-1ubuntu1.md) | Feb 11, 2025 | | Linux | openssl almalinux 9 | 1:3.2.2-6.el9_5.1 | [ALSA-2025:1330](https://patchblox.com/security/data/fix/linux/alsa-2025-1330.md) | Feb 11, 2025 | | Linux | openssl ol 9 | 1:3.2.2-6.0.1.el9_5.1 | [ELSA-2025-1330](https://patchblox.com/security/data/fix/linux/elsa-2025-1330.md) | Feb 12, 2025 | | Linux | openssl rocky 9 | 1:3.2.2-6.el9_5.1 | [RLSA-2025:1330](https://patchblox.com/security/data/fix/linux/rlsa-2025-1330.md) | Mar 17, 2025 | | Linux | openssl-3 sles 15.7 | 3.2.3-150700.5.5.1 | [SUSE-SU-2025:02042-1](https://patchblox.com/security/data/fix/linux/suse-su-2025-02042-1.md) | Jun 20, 2025 | | Linux | openssl-devel RHEL 9 | 1:3.2.2-6.el9_5.1 | [RHSA-2025:1330](https://patchblox.com/security/data/fix/linux/rhsa-2025-1330.md) | Feb 11, 2025 | | Linux | openssl-devel almalinux 9 | 1:3.2.2-6.el9_5.1 | [ALSA-2025:1330](https://patchblox.com/security/data/fix/linux/alsa-2025-1330.md) | Feb 11, 2025 | | Linux | openssl-devel ol 9 | 1:3.2.2-6.0.1.el9_5.1 | [ELSA-2025-1330](https://patchblox.com/security/data/fix/linux/elsa-2025-1330.md) | Feb 12, 2025 | | Linux | openssl-libs RHEL 9 | 1:3.2.2-6.el9_5.1 | [RHSA-2025:1330](https://patchblox.com/security/data/fix/linux/rhsa-2025-1330.md) | Feb 11, 2025 | | Linux | openssl-libs almalinux 9 | 1:3.2.2-6.el9_5.1 | [ALSA-2025:1330](https://patchblox.com/security/data/fix/linux/alsa-2025-1330.md) | Feb 11, 2025 | | Linux | openssl-libs ol 9 | 1:3.2.2-6.0.1.el9_5.1 | [ELSA-2025-1330](https://patchblox.com/security/data/fix/linux/elsa-2025-1330.md) | Feb 12, 2025 | | Linux | openssl-perl RHEL 9 | 1:3.2.2-6.el9_5.1 | [RHSA-2025:1330](https://patchblox.com/security/data/fix/linux/rhsa-2025-1330.md) | Feb 11, 2025 | | Linux | openssl-perl almalinux 9 | 1:3.2.2-6.el9_5.1 | [ALSA-2025:1330](https://patchblox.com/security/data/fix/linux/alsa-2025-1330.md) | Feb 11, 2025 | | Linux | openssl-perl ol 9 | 1:3.2.2-6.0.1.el9_5.1 | [ELSA-2025-1330](https://patchblox.com/security/data/fix/linux/elsa-2025-1330.md) | Feb 12, 2025 | | Linux | openssl-provider-legacy Ubuntu 25.04 (plucky) | 3.4.1-1ubuntu1 | [openssl-provider-legacy 3.4.1-1ubuntu1](https://patchblox.com/security/data/fix/linux/ubuntu-plucky-openssl-provider-legacy-3.4.1-1ubuntu1.md) | Feb 11, 2025 | --- Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.