{"answers":{"affected":"3 open source packages ship an affected version, including cryptography.","exploited":"There is no known exploitation of CVE-2024-12797 in the wild and no public exploit code.","fix":"Upgrade cryptography to 44.0.1 or later.","what":"CVE-2024-12797 is a medium-severity vulnerability in OpenSSL, published on 11 Feb 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2024-12797 and fix it if it is affected.\n\nWhat it is: CVE-2024-12797 is a medium-severity vulnerability in OpenSSL, published on 11 Feb 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2024-12797 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- cryptography (PyPI): affected from 42.0.0; fixed in 44.0.1\n- cryptography (PyPI): affected from 42.0.0; fixed in 44.0.1\n- cryptography (PyPI): affected from 42.0.0; fixed in 44.0.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2024-12797/ (Markdown: https://insights.sbomify.com/CVE-2024-12797/index.md)","id":"CVE-2024-12797","markdown":"https://insights.sbomify.com/CVE-2024-12797/index.md","name":"CVE-2024-12797","record":{"aliases":["ALPINE-CVE-2024-12797","ALSA-2025:1330","AZL-56761","AZL-56774","AZL-78591","BELL-CVE-2024-12797","CLEANSTART-2026-CA76022","CLEANSTART-2026-XR87618","CLSA-2025-1750637629","CLSA-2025-1750637631","CLSA-2025-1751550314","CLSA-2025-1752624830","CLSA-2026-1772151044","DEBIAN-CVE-2024-12797","ECHO-6181-2240-677d","GHSA-79v4-65xg-pq4g","MINI-28qj-wm62-7w9w","MINI-j384-f4q6-cfjg","PYSEC-2026-1284","RHBA-2025:6314","RHSA-2025:1330","RLSA-2025:1330","ROOT-APP-PYPI-CVE-2024-12797","ROOT-OS-ALPINE-318-CVE-2024-12797","openSUSE-SU-2025:14802-1"],"analysis":{"component_type":"library","fix_type":"patch","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"OpenSSL TLS library","requires_auth":"none","summary":"Attackers can perform man-in-the-middle attacks against TLS clients using Raw Public Keys if server authentication failures are not explicitly checked.","user_interaction":"required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"openssl","cpe":[],"cvss":{"score":6.3,"severity":"medium","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","version":"3.1"},"cwes":[{"id":"CWE-392","name":"Missing Report of Error Condition"}],"description":"Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a\nserver may fail to notice that the server was not authenticated, because\nhandshakes don't abort as expected when the SSL_VERIFY_PEER verification mode\nis set.\n\nImpact summary: TLS and DTLS connections using raw public keys may be\nvulnerable to man-in-middle attacks when server authentication failure is not\ndetected by clients.\n\nRPKs are disabled by default in both TLS clients and TLS servers.  The issue\nonly arises when TLS clients explicitly enable RPK use by the server, and the\nserver, likewise, enables sending of an RPK instead of an X.509 certificate\nchain.  The affected clients are those that then rely on the handshake to\nfail when the server's RPK fails to match one of the expected public keys,\nby setting the verification mode to SSL_VERIFY_PEER.\n\nClients that enable server-side raw public keys can still find out that raw\npublic key verification failed by calling SSL_get_verify_result(), and those\nthat do, and take appropriate action, are not affected.  This issue was\nintroduced in the initial implementation of RPK support in OpenSSL 3.2.\n\nThe FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.","ecosystems":["AlmaLinux:9","PyPI","Red Hat:enterprise_linux:10.0","Red Hat:enterprise_linux:9::appstream","Red Hat:enterprise_linux:9::baseos","Rocky Linux:9","openSUSE:Tumbleweed"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"RFC7250 handshakes with unauthenticated servers don't abort as expected","id":"CVE-2024-12797","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"security_feature_bypass","year":"2024"},"n_packages":26,"n_references":4,"next":{"headline":"JaninoEventEvaluator vulnerability","id":"CVE-2024-12798"},"packages":[{"ecosystem":"PyPI","fixed":["44.0.1"],"introduced":["42.0.0"],"last_affected":[],"package":"cryptography","purl":null,"source":"GHSA-79v4-65xg-pq4g"},{"ecosystem":"PyPI","fixed":["44.0.1"],"introduced":["42.0.0"],"last_affected":[],"package":"cryptography","purl":"pkg:pypi/cryptography","source":"GHSA-79v4-65xg-pq4g"},{"ecosystem":"PyPI","fixed":["44.0.1"],"introduced":["42.0.0"],"last_affected":[],"package":"cryptography","purl":"pkg:pypi/cryptography","source":"PYSEC-2026-1284"},{"ecosystem":"AlmaLinux:9","fixed":["1:3.2.2-6.el9_5.1"],"introduced":["0"],"last_affected":[],"package":"openssl","purl":"pkg:rpm/almalinux/openssl","source":"ALSA-2025:1330"},{"ecosystem":"AlmaLinux:9","fixed":["1:3.2.2-6.el9_5.1"],"introduced":["0"],"last_affected":[],"package":"openssl-devel","purl":"pkg:rpm/almalinux/openssl-devel","source":"ALSA-2025:1330"},{"ecosystem":"AlmaLinux:9","fixed":["1:3.2.2-6.el9_5.1"],"introduced":["0"],"last_affected":[],"package":"openssl-libs","purl":"pkg:rpm/almalinux/openssl-libs","source":"ALSA-2025:1330"},{"ecosystem":"AlmaLinux:9","fixed":["1:3.2.2-6.el9_5.1"],"introduced":["0"],"last_affected":[],"package":"openssl-perl","purl":"pkg:rpm/almalinux/openssl-perl","source":"ALSA-2025:1330"},{"ecosystem":"Red Hat:enterprise_linux:10.0","fixed":["1:3.2.2-16.el10"],"introduced":["0"],"last_affected":[],"package":"openssl","purl":"pkg:rpm/redhat/openssl","source":"RHBA-2025:6314"},{"ecosystem":"Red Hat:enterprise_linux:10.0","fixed":["1:3.2.2-16.el10"],"introduced":["0"],"last_affected":[],"package":"openssl-debuginfo","purl":"pkg:rpm/redhat/openssl-debuginfo","source":"RHBA-2025:6314"},{"ecosystem":"Red Hat:enterprise_linux:10.0","fixed":["1:3.2.2-16.el10"],"introduced":["0"],"last_affected":[],"package":"openssl-debugsource","purl":"pkg:rpm/redhat/openssl-debugsource","source":"RHBA-2025:6314"},{"ecosystem":"Red Hat:enterprise_linux:10.0","fixed":["1:3.2.2-16.el10"],"introduced":["0"],"last_affected":[],"package":"openssl-devel","purl":"pkg:rpm/redhat/openssl-devel","source":"RHBA-2025:6314"},{"ecosystem":"Red Hat:enterprise_linux:10.0","fixed":["1:3.2.2-16.el10"],"introduced":["0"],"last_affected":[],"package":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs","source":"RHBA-2025:6314"},{"ecosystem":"Red Hat:enterprise_linux:10.0","fixed":["1:3.2.2-16.el10"],"introduced":["0"],"last_affected":[],"package":"openssl-libs-debuginfo","purl":"pkg:rpm/redhat/openssl-libs-debuginfo","source":"RHBA-2025:6314"},{"ecosystem":"Red Hat:enterprise_linux:10.0","fixed":["1:3.2.2-16.el10"],"introduced":["0"],"last_affected":[],"package":"openssl-perl","purl":"pkg:rpm/redhat/openssl-perl","source":"RHBA-2025:6314"},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","fixed":["1:3.2.2-6.el9_5.1"],"introduced":["0"],"last_affected":[],"package":"openssl-debuginfo","purl":"pkg:rpm/redhat/openssl-debuginfo","source":"RHSA-2025:1330"},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","fixed":["1:3.2.2-6.el9_5.1"],"introduced":["0"],"last_affected":[],"package":"openssl-debugsource","purl":"pkg:rpm/redhat/openssl-debugsource","source":"RHSA-2025:1330"},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","fixed":["1:3.2.2-6.el9_5.1"],"introduced":["0"],"last_affected":[],"package":"openssl-devel","purl":"pkg:rpm/redhat/openssl-devel","source":"RHSA-2025:1330"},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","fixed":["1:3.2.2-6.el9_5.1"],"introduced":["0"],"last_affected":[],"package":"openssl-libs-debuginfo","purl":"pkg:rpm/redhat/openssl-libs-debuginfo","source":"RHSA-2025:1330"},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","fixed":["1:3.2.2-6.el9_5.1"],"introduced":["0"],"last_affected":[],"package":"openssl-perl","purl":"pkg:rpm/redhat/openssl-perl","source":"RHSA-2025:1330"},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","fixed":["1:3.2.2-6.el9_5.1"],"introduced":["0"],"last_affected":[],"package":"openssl","purl":"pkg:rpm/redhat/openssl","source":"RHSA-2025:1330"},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","fixed":["1:3.2.2-6.el9_5.1"],"introduced":["0"],"last_affected":[],"package":"openssl-debuginfo","purl":"pkg:rpm/redhat/openssl-debuginfo","source":"RHSA-2025:1330"},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","fixed":["1:3.2.2-6.el9_5.1"],"introduced":["0"],"last_affected":[],"package":"openssl-debugsource","purl":"pkg:rpm/redhat/openssl-debugsource","source":"RHSA-2025:1330"},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","fixed":["1:3.2.2-6.el9_5.1"],"introduced":["0"],"last_affected":[],"package":"openssl-libs","purl":"pkg:rpm/redhat/openssl-libs","source":"RHSA-2025:1330"},{"ecosystem":"Red Hat:enterprise_linux:9::baseos","fixed":["1:3.2.2-6.el9_5.1"],"introduced":["0"],"last_affected":[],"package":"openssl-libs-debuginfo","purl":"pkg:rpm/redhat/openssl-libs-debuginfo","source":"RHSA-2025:1330"},{"ecosystem":"Rocky Linux:9","fixed":["1:3.2.2-6.el9_5.1"],"introduced":["0"],"last_affected":[],"package":"openssl","purl":"pkg:rpm/rocky-linux/openssl?distro=rocky-linux-9\u0026epoch=1","source":"RLSA-2025:1330"},{"ecosystem":"openSUSE:Tumbleweed","fixed":["3.2.4-1.1"],"introduced":["0"],"last_affected":[],"package":"openssl-3","purl":"pkg:rpm/opensuse/openssl-3\u0026distro=openSUSE%20Tumbleweed","source":"openSUSE-SU-2025:14802-1"}],"prev":{"headline":"Reflected XSS in Holistic IT, Consultancy Coop.'s Workcube ERP","id":"CVE-2024-12796"},"products":["OpenSSL"],"published":"2025-02-11","related":[],"sources":[{"class":"attribution","licence":"MIT","name":"AlmaLinux","prefix":"ALSA"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"PyPA Advisory Database","prefix":"PYSEC"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHBA"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"BSD","name":"Rocky Linux","prefix":"RLSA"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-02-18","vendors":["OpenSSL"]},"summary":"Attackers can perform man-in-the-middle attacks against TLS clients using Raw Public Keys if server authentication failures are not explicitly checked.","url":"https://insights.sbomify.com/CVE-2024-12797/"}