Microsoft security update for CVE-2024-0727
🔗 CVE IDs covered (1)
📋 Microsoft's advisory
EchelonGraph does not copy Microsoft's advisory page: its FAQ and remediation text are not shown here. Read the advisory on https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-0727. This page also shows what EchelonGraph holds for CVE-2024-0727, with the description from its CVE record, which the CVE Numbering Authority that assigned the CVE wrote: for a CVE Microsoft assigned, often in the words of Microsoft's own advisory.
🎯 Affected products14
- azl3 cloud-hypervisor-cvm 38.0.72-2 on Azure Linux 3.0
- azl3 cloud-hypervisor-cvm 38.0.72.2-1 on Azure Linux 3.0
- azl3 kata-containers 3.2.0.azl0-2 on Azure Linux 3.0
- azl3 kata-containers 3.2.0.azl1-1 on Azure Linux 3.0
- azl3 nodejs 16.20.2-2 on Azure Linux 3.0
- azl3 openssl 1.1.1k-29 on Azure Linux 3.0
- azl3 openssl 3.1.4-9 on Azure Linux 3.0
- cbl2 cloud-hypervisor-cvm 38.0.72-1 on CBL Mariner 2.0
- cbl2 cloud-hypervisor-cvm 38.0.72.2-1 on CBL Mariner 2.0
- cbl2 hvloader 1.0.1-11 on CBL Mariner 2.0
- cbl2 hvloader 1.0.1-9 on CBL Mariner 2.0
- cbl2 nodejs 16.20.2-2 on CBL Mariner 2.0
- cbl2 openssl 1.1.1k-29 on CBL Mariner 2.0
- cbl2 openssl 1.1.1k-36 on CBL Mariner 2.0
✅ Updates Microsoft lists: 9 updates
9 rows: one per KB article or update, update type and fixed build. Their details are on Microsoft's advisory.
| KB article | Update | Fixed build |
|---|---|---|
| — | Security Update | - |
| — | Security Update | 1.0.1-9 |
| — | Security Update | 1.1.1k-29 |
| — | Security Update | 16.20.2-2 |
| — | Security Update | 3.2.0.azl1-1 |
| — | Security Update | — |
| — | Security Update | 1.0.1-3 |
| — | Security Update | 38.0.72.2-1 |
| — | Security Update | 3.3.0-1 |
🧭 EchelonGraph on CVE-2024-0727
- EchelonGraph score
- 5.5 MEDIUM
- CISA KEV
- Not listed
- Fix status
- A fix is available — apply it.
Description from the CVE record (CVE.org), as published by its numbering authority
Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack Impact summary: Applications loading files in the PKCS12 format from untrusted sources might terminate abruptly. A file in PKCS12 format can contain certificates and keys and may come from an untrusted source. The PKCS12 specification allows certain fields to be NULL, but OpenSSL does not correctly check for this case. This can lead to a NULL pointer dereference that results in OpenSSL crashing. If an application processes PKCS12 files from an untrusted source using the OpenSSL APIs then that application will be vulnerable to this issue. OpenSSL APIs that are vulnerable to this are: PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() and PKCS12_newpass(). We have also fixed a similar issue in SMIME_write_PKCS7(). However since this function is related to writing data we do not consider it security significant. The FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.
Published by OpenSSL Software Foundation, the CVE Numbering Authority that assigned CVE-2024-0727, in its CVE record at CVE.org; reused under the CVE Program's Terms of Use (its licence and MITRE's copyright notice are in our Terms of Service).