Loading vulnerability…
Raw Public Key Server Authentication Bypass in OpenSSL
CVE-2024-12797 is a server-authentication flaw in OpenSSL's RFC7250 Raw Public Key (RPK) support, introduced in OpenSSL 3.2. Affected TLS and DTLS clients configured with SSL_VERIFY_PEER may complete a handshake even when the server's RPK does not match an expected public key. Applications relying solely on handshake failure can consequently accept an unauthenticated server, exposing connections to man-in-the-middle attacks. The vulnerability affects OpenSSL 3.2 before 3.2.4, 3.3 before 3.3.3, and 3.4 before 3.4.1. RPK support is disabled by default. OpenSSL 3.1, 3.0, 1.1.1, and 1.0.2, and the FIPS modules in OpenSSL 3.0 through 3.4, are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Affected clients can establish TLS or DTLS connections without successfully authenticating the server's raw public key. This permits server impersonation and creates a man-in-the-middle risk, potentially exposing application communications to interception or manipulation. Clients that explicitly check SSL_get_verify_result() and appropriately reject verification failures are not affected.
If you can’t patch tonight, do this now.
Explicitly call SSL_get_verify_result() and reject connections when raw public key verification fails rather than relying exclusively on SSL_VERIFY_PEER to abort the handshake. Alternatively, disable server raw public key authentication where it is not required; RPK support is disabled by default.
Patch, then assume compromise.
Upgrade OpenSSL 3.2 to 3.2.4 or later, OpenSSL 3.3 to 3.3.3 or later, or OpenSSL 3.4 to 3.4.1 or later, or install the corresponding vendor-patched package. For affected cryptography packages, update to version 44.0.1 or later. Update affected bundled applications and container images using their vendor security releases.
No public exploits tracked yet. Mallory keeps watching.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.