REDHAT-BUG-2430387: Null Pointer Dereference

Published Jan 16, 2026

Updated

Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12itemdecryptd2iex() function.

Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files.

The PKCS12itemdecryptd2iex() function does not check whether the oct parameter is NULL before dereferencing it. When called from PKCS12unpackp7encdata() with a malformed PKCS#12 file, this parameter can be NULL, causing a crash. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure.

Exploiting this issue requires an attacker to provide a malformed PKCS#12 file to an application that processes it. For that reason the issue was assessed as Low severity according to our Security Policy.

The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.

OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.

OpenSSL 3.6 users should upgrade to OpenSSL 3.6.1.

OpenSSL 3.5 users should upgrade to OpenSSL 3.5.5.

OpenSSL 3.4 users should upgrade to OpenSSL 3.4.4.

OpenSSL 3.3 users should upgrade to OpenSSL 3.3.6.

OpenSSL 3.0 users should upgrade to OpenSSL 3.0.19.

OpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1ze (premium support customers only).

OpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zn (premium support customers only).

Affected Software

1 affected component

OpenSSL OpenSSL=1.0.2, =1.1.1, >=3.0, >=3.3, >=3.4, >=3.5, >=3.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenSSL to a version that resolves this vulnerability.
Fixed in 1.0.2zn
Upgrade
Upgrade OpenSSL to a version that resolves this vulnerability.
Fixed in 1.1.1ze
Upgrade
Upgrade OpenSSL to a version that resolves this vulnerability.
Fixed in 3.0.19
Upgrade
Upgrade OpenSSL to a version that resolves this vulnerability.
Fixed in 3.3.6
Upgrade
Upgrade OpenSSL to a version that resolves this vulnerability.
Fixed in 3.4.4
Upgrade
Upgrade OpenSSL to a version that resolves this vulnerability.
Fixed in 3.5.5
Upgrade
Upgrade OpenSSL to a version that resolves this vulnerability.
Fixed in 3.6.1

Event History

Jan 16, 2026

Data Sourced

via Red Hat·02:42 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2430387?

The severity of REDHAT-BUG-2430387 is critical due to its potential to cause Denial of Service through application crashes.

How do I fix REDHAT-BUG-2430387?

To fix REDHAT-BUG-2430387, update OpenSSL to a patched version as outlined in official advisories.

Which versions of OpenSSL are affected by REDHAT-BUG-2430387?

Affected versions of OpenSSL include 1.0.2, 1.1.1, and all versions from 3.0 through 3.6.

What types of applications are impacted by REDHAT-BUG-2430387?

Applications that process PKCS#12 files are impacted by REDHAT-BUG-2430387, leading to potential crashes.

What are the consequences of not addressing REDHAT-BUG-2430387?

Not addressing REDHAT-BUG-2430387 could result in unexpected application downtime and service disruption.