This vulnerability (CVE-2024-12797) is due to improper certificate validation in OpenSSL's implementation of RFC7250 Raw Public Key (RPK) authentication. Specifically, when RPK is enabled on both TLS clients and servers, the TLS/DTLS handshake fails to abort if the server's RPK does not match the expected key, even though SSL_VERIFY_PEER verification mode is set. This flaw allows an attacker to perform man-in-the-middle attacks by spoofing the server's identity. The vulnerability was introduced in OpenSSL 3.2, first shipped in RHEL 9.5, and affects Red Hat OpenShift Builds versions 1.2 through 1.3. RPK is disabled by default, so only users who explicitly enable RPK are affected. Ruby packages in RHEL are not affected as they do not expose RPK functions. No official fix is currently available, and mitigation options do not meet Red Hat's criteria for ease of use or applicability. Users are advised to monitor Red Hat advisories for future updates.

The vulnerability allows an attacker to bypass TLS authentication by exploiting the failure to abort handshakes when the server's raw public key does not match the expected key. This can lead to man-in-the-middle attacks, enabling attackers to intercept or spoof communications that clients believe are secure. Confidentiality and integrity of communications are at high risk. Availability is not impacted. The issue affects only configurations where RPK is explicitly enabled on both client and server sides.

Currently, no official fix or patch is available for this vulnerability. Red Hat advises users to upgrade to supported product versions beyond 1.3 when available. Since RPK is disabled by default, users should avoid enabling RPK on TLS clients and servers unless necessary. Clients that explicitly check the verification result via SSL_get_verify_result() and handle failures appropriately are not affected. Users should monitor Red Hat advisories for future patches or updates. No additional mitigations meeting Red Hat's criteria are currently recommended.