Bug 2344954

Summary: SEVERITY: HIGH; handshakes with unauthenticated servers don't abort as expected (CVE-2024-12797)
Product: [Fedora] Fedora Reporter: pgnd <pgnd>
Component: opensslAssignee: Dmitry Belyavskiy <dbelyavs>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: unspecified    
Version: 41CC: crypto-team, dbelyavs, mspacek, mturk, shebburn, suraj.ghimire7, tm
Target Milestone: ---Keywords: Security, Triaged
Target Release: ---Flags: fedora-admin-xmlrpc: mirror+
Hardware: All   
OS: Linux   
URL: https://openssl-library.org/news/secadv/20250211.txt
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2025-03-14 13:42:12 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description pgnd 2025-02-11 16:44:22 UTC 
SEVERITY: HIGH; handshakes with unauthenticated servers don't abort as expected (CVE-2024-12797)

OpenSSL Security Advisory [11th February 2025]
 RFC7250 handshakes with unauthenticated servers don't abort as expected (CVE-2024-12797)
 https://openssl-library.org/news/secadv/20250211.txt
 
	The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
	OpenSSL 3.1, 3.0, 1.1.1 and 1.0.2 are also not affected by this issue.

	OpenSSL 3.4, 3.3 and 3.2 are vulnerable to this issue.

	OpenSSL 3.4 users should upgrade to OpenSSL 3.4.1.

	OpenSSL 3.3 users should upgrade to OpenSSL 3.3.2.

!!>	OpenSSL 3.2 users should upgrade to OpenSSL 3.2.4.


distro
	Name: Fedora Linux 41 (Server Edition)
	Version: 41
	Codename:

rpm -qa | grep -i ^openssl | sort
	openssl-3.2.2-11.fc41.x86_64
	openssl-devel-3.2.2-11.fc41.x86_64
	openssl-libs-3.2.2-11.fc41.x86_64
openssl-pkcs11-0.4.12-10.fc41.x86_64

Reproducible: Always
Comment 1 Dmitry Belyavskiy 2025-03-14 13:42:12 UTC 
Implemented via rebase