# CVE-2024-12797: RFC7250 handshakes with unauthenticated servers don't abort as expected

Status: published. Published: 2025-02-11. Updated: 2026-11-06.

Issue summary: Clients using RFC7250 Raw Public Keys (RPKs) to authenticate a
server may fail to notice that the server was not authenticated, because
handshakes don't abort as expected when the SSL_VERIFY_PEER verification mode
is set.

Impact summary: TLS and DTLS connections using raw public keys may be
vulnerable to man-in-middle attacks when server authentication failure is not
detected by clients.

RPKs are disabled by default in both TLS clients and TLS servers.  The issue
only arises when TLS clients explicitly enable RPK use by the server, and the
server, likewise, enables sending of an RPK instead of an X.509 certificate
chain.  The affected clients are those that then rely on the handshake to
fail when the server's RPK fails to match one of the expected public keys,
by setting the verification mode to SSL_VERIFY_PEER.

Clients that enable server-side raw public keys can still find out that raw
public key verification failed by calling SSL_get_verify_result(), and those
that do, and take appropriate action, are not affected.  This issue was
introduced in the initial implementation of RPK support in OpenSSL 3.2.

The FIPS modules in 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

## Remediation

- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: openssl) — https://github.com/openssl/openssl/commit/738d4f9fdeaad57660dcba50a619fafced3fd5e9
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: openssl) — https://github.com/openssl/openssl/commit/87ebd203feffcf92ad5889df92f90bb0ee10a699
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: CNA: openssl) — https://github.com/openssl/openssl/commit/798779d43494549b611233f92652f0da5328fbe7
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: openssl-security@openssl.org) — https://github.com/openssl/openssl/commit/738d4f9fdeaad57660dcba50a619fafced3fd5e9
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: openssl-security@openssl.org) — https://github.com/openssl/openssl/commit/798779d43494549b611233f92652f0da5328fbe7
- fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: openssl-security@openssl.org) — https://github.com/openssl/openssl/commit/87ebd203feffcf92ad5889df92f90bb0ee10a699

## Affected products and versions

- OpenSSL / OpenSSL: ≥ 3.4.0; < 3.4.1 (affected, semver); ≥ 3.3.0; < 3.3.3 (affected, semver); ≥ 3.2.0; < 3.2.4 (affected, semver). Source: CNA: openssl

## NVD configuration conditions

Affected CPE matches depend on the following AND/OR and negation conditions:

```json
[
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "3.2.4",
            "versionStartIncluding": "3.2.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "3.3.3",
            "versionStartIncluding": "3.3.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
            "versionEndExcluding": "3.4.1",
            "versionStartIncluding": "3.4.0",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:netapp:brocade_fabric_operating_system:-:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:*",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:*",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]
```

## Severity and prioritization

- CVSS 3.1: 7.4 (high); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N; source: ADP: CISA-ADP

- CVSS 3.1: 7.4 (high); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N; source: NVD: 134c704f-9b21-4f2e-91b3-4a467353bcc0

- CISA KEV: No listing in collected sources

- EPSS: 2.53% as of 2026-11-06; percentile 84.98%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-392

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://openssl-library.org/news/secadv/20250211.txt (CNA: openssl; vendor-advisory)

- https://github.com/openssl/openssl/commit/738d4f9fdeaad57660dcba50a619fafced3fd5e9 (CNA: openssl; patch)

- https://github.com/openssl/openssl/commit/87ebd203feffcf92ad5889df92f90bb0ee10a699 (CNA: openssl; patch)

- https://github.com/openssl/openssl/commit/798779d43494549b611233f92652f0da5328fbe7 (CNA: openssl; patch)

- http://www.openwall.com/lists/oss-security/2025/02/11/3 (ADP: CVE)

- http://www.openwall.com/lists/oss-security/2025/02/11/4 (ADP: CVE)

- https://security.netapp.com/advisory/ntap-20250214-0001/ (ADP: CVE)

- https://github.com/openssl/openssl/commit/738d4f9fdeaad57660dcba50a619fafced3fd5e9 (openssl-security@openssl.org; Patch)

- https://github.com/openssl/openssl/commit/798779d43494549b611233f92652f0da5328fbe7 (openssl-security@openssl.org; Patch)

- https://github.com/openssl/openssl/commit/87ebd203feffcf92ad5889df92f90bb0ee10a699 (openssl-security@openssl.org; Patch)

- https://openssl-library.org/news/secadv/20250211.txt (openssl-security@openssl.org; Vendor Advisory)

- http://www.openwall.com/lists/oss-security/2025/02/11/3 (af854a3a-2127-422b-91ae-364da2661108; Mailing List, Third Party Advisory)

- http://www.openwall.com/lists/oss-security/2025/02/11/4 (af854a3a-2127-422b-91ae-364da2661108; Mailing List, Third Party Advisory)

- https://security.netapp.com/advisory/ntap-20250214-0001/ (af854a3a-2127-422b-91ae-364da2661108; Third Party Advisory)

## Provenance

- CNA: openssl: https://www.cve.org/CVERecord?id=CVE-2024-12797; retrieved 2026-11-06; source updated 2026-11-06

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-12797; retrieved 2026-11-07; source updated 2026-11-06

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2024-12797; retrieved 2026-11-06; source updated Not reported

Revision: b74e172fbbd244a7f0f35de11b665a79f7b25a3d67a85e758a83db0e20fc07d0

Canonical: https://y2.dev/cve/CVE-2024-12797

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.