Skip to main content
CVE-2024-12797VulnerabilityPublished 02/11/2025Updated 10/21/2026

Red Hat Security Advisory: openssl security update

Affects Red Hat Product Security Red HatSource GCVE Database

0

Not known to be exploited · fixed in 2.70.0 : patch Red Hat Product Security Red Hat as a priority.

Data as of 10/25/2026, 04:40:08 UTC

Severity
Critical

No CVSS score from NVD or the CNA

Exploitation

Not in CISA KEV, no exploitation reported

EPSS
2.5% chance of exploitation in 30 days – higher than 84% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch
Available – fixed in 2.70.0

What to do

Affected software

ProductAffectedFixed in
Homebrewazure-clipkg:brew/azure-cliOther threatsAffected
  • >=2.59.0 <2.70.0
Fixed in
  • 2.70.0

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

Red Hat has released official security updates for OpenSSL to address this vulnerability. Users should apply the provided updates for Red Hat Enterprise Linux 9 and 10 as detailed in the Red Hat advisories (RHSA-2025:1330 and RHBA-2025:6314). For detailed update instructions, refer to https://access.redhat.com/articles/11258. Applying these updates will remediate the vulnerability.

Description

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 42.0.0-44.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20250211.txt. If you are building cryptography source ("sdist") then you are responsible for upgrading your copy of OpenSSL. Only users installing from wheels built by the cryptography project (i.e., those distributed on PyPI) need to update their cryptography versions.

Impact

The vulnerability could lead to improper handling of TLS handshakes with unauthenticated servers, which may undermine the security guarantees of SSL/TLS connections. However, no known exploits in the wild have been reported. The impact is rated as important by Red Hat, indicating a significant security concern but not necessarily critical.

Summary

CVE-2024-12797 is a vulnerability in OpenSSL where RFC7250 handshakes with unauthenticated servers fail to abort as expected, potentially causing security protocol issues. This affects OpenSSL packages in Red Hat Enterprise Linux 9 and 10 distributions. Red Hat has released security updates to address this issue, with updated OpenSSL packages available for multiple architectures and extended update support versions. The vulnerability is associated with CWE-295 (Improper Certificate Validation).

Weaknesses

References

Community reviews

Loading reviews…