CVE-2024-6119

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-6119
Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. Impact summary: Abnormal termination of an application can a cause a denial of service. Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address when comparing the expected name with an `otherName` subject alternative name of an X.509 certificate. This may result in an exception that terminates the application program. Note that basic certificate chain validation (signatures, dates, ...) is not affected, the denial of service can occur only when the application also specifies an expected DNS name, Email address or IP address. TLS servers rarely solicit client certificates, and even when they do, they generally don't perform a name check against a reference identifier (expected identity), but rather extract the presented identity after checking the certificate chain. So TLS servers are generally not affected and the severity of the issue is Moderate. The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/openssl/openssl/commit/05f360d9e849a1b277db628f1f13083a7f8dd04f Patch
https://github.com/openssl/openssl/commit/06d1dc3fa96a2ba5a3e22735a033012aadc9f0d6 Patch
https://github.com/openssl/openssl/commit/621f3729831b05ee828a3203eddb621d014ff2b2 Patch
https://github.com/openssl/openssl/commit/7dfcee2cd2a63b2c64b9b4b0850be64cb695b0a0 Patch
https://openssl-library.org/news/secadv/20240903.txt Vendor Advisory
http://www.openwall.com/lists/oss-security/2024/09/03/4 Mailing List
https://lists.freebsd.org/archives/freebsd-security/2024-September/000303.html Mailing List
https://security.netapp.com/advisory/ntap-20240912-0001/ Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_9:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:o:netapp:brocade_fabric_operating_system:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Configuration 12 (hide)

AND
cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*

Configuration 13 (hide)

AND
cpe:2.3:o:netapp:500f_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:500f:-:*:*:*:*:*:*:*

Configuration 14 (hide)

AND
cpe:2.3:o:netapp:c250_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:c250:-:*:*:*:*:*:*:*
History

03 Jun 2025, 10:51

Type Values Removed Values Added
First Time Netapp h300s
Netapp ontap 9
Netapp hci Compute Node
Netapp h615c Firmware
Netapp h300s Firmware
Netapp c250 Firmware
Netapp a250 Firmware
Netapp h410s Firmware
Netapp 500f
Netapp h410c
Openssl
Netapp h610s Firmware
Netapp h500s
Netapp 500f Firmware
Netapp h500s Firmware
Netapp ontap Select Deploy Administration Utility
Netapp a250
Openssl openssl
Netapp h700s
Netapp brocade Fabric Operating System
Netapp h610c Firmware
Netapp h610c
Netapp h410s
Netapp c250
Netapp bootstrap Os
Netapp h410c Firmware
Netapp ontap Tools
Netapp management Services For Element Software And Netapp Hci
Netapp h615c
Netapp
Netapp active Iq Unified Manager
Netapp h610s
Netapp h700s Firmware
References () https://github.com/openssl/openssl/commit/05f360d9e849a1b277db628f1f13083a7f8dd04f - () https://github.com/openssl/openssl/commit/05f360d9e849a1b277db628f1f13083a7f8dd04f - Patch
References () https://github.com/openssl/openssl/commit/06d1dc3fa96a2ba5a3e22735a033012aadc9f0d6 - () https://github.com/openssl/openssl/commit/06d1dc3fa96a2ba5a3e22735a033012aadc9f0d6 - Patch
References () https://github.com/openssl/openssl/commit/621f3729831b05ee828a3203eddb621d014ff2b2 - () https://github.com/openssl/openssl/commit/621f3729831b05ee828a3203eddb621d014ff2b2 - Patch
References () https://github.com/openssl/openssl/commit/7dfcee2cd2a63b2c64b9b4b0850be64cb695b0a0 - () https://github.com/openssl/openssl/commit/7dfcee2cd2a63b2c64b9b4b0850be64cb695b0a0 - Patch
References () https://openssl-library.org/news/secadv/20240903.txt - () https://openssl-library.org/news/secadv/20240903.txt - Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2024/09/03/4 - () http://www.openwall.com/lists/oss-security/2024/09/03/4 - Mailing List
References () https://lists.freebsd.org/archives/freebsd-security/2024-September/000303.html - () https://lists.freebsd.org/archives/freebsd-security/2024-September/000303.html - Mailing List
References () https://security.netapp.com/advisory/ntap-20240912-0001/ - () https://security.netapp.com/advisory/ntap-20240912-0001/ - Third Party Advisory
CPE cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:brocade_fabric_operating_system:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_9:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
cpe:2.3:h:netapp:500f:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:500f_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:ontap_tools:9:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:c250:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:c250_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

21 Nov 2024, 09:49

Type Values Removed Values Added
Summary
  • (es) Resumen del problema: Las aplicaciones que realizan comprobaciones de nombres de certificados (por ejemplo, clientes TLS que comprueban certificados de servidor) pueden intentar leer una dirección de memoria no válida, lo que da como resultado la finalización anormal del proceso de la aplicación. Resumen del impacto: La finalización anormal de una aplicación puede causar una denegación de servicio. Las aplicaciones que realizan comprobaciones de nombres de certificados (por ejemplo, clientes TLS que comprueban certificados de servidor) pueden intentar leer una dirección de memoria no válida al comparar el nombre esperado con un nombre alternativo de sujeto `otherName` de un certificado X.509. Esto puede dar como resultado una excepción que finalice el programa de aplicación. Tenga en cuenta que la validación básica de la cadena de certificados (firmas, fechas, ...) no se ve afectada, la denegación de servicio puede ocurrir solo cuando la aplicación también especifica un nombre DNS, una dirección de correo electrónico o una dirección IP esperados. Los servidores TLS rara vez solicitan certificados de cliente, e incluso cuando lo hacen, generalmente no realizan una comprobación de nombre contra un identificador de referencia (identidad esperada), sino que extraen la identidad presentada después de comprobar la cadena de certificados. Por lo tanto, los servidores TLS generalmente no se ven afectados y la gravedad del problema es moderada. Los módulos FIPS en 3.3, 3.2, 3.1 y 3.0 no se ven afectados por este problema.
References
  • () http://www.openwall.com/lists/oss-security/2024/09/03/4 -
  • () https://lists.freebsd.org/archives/freebsd-security/2024-September/000303.html -
  • () https://security.netapp.com/advisory/ntap-20240912-0001/ -

03 Sep 2024, 21:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

03 Sep 2024, 16:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-09-03 16:15

Updated : 2025-06-03 10:51

NVD link : CVE-2024-6119

Mitre link : CVE-2024-6119

CVE.ORG link : CVE-2024-6119

JSON object : View

Products Affected

netapp

  • a250_firmware
  • h500s
  • brocade_fabric_operating_system
  • ontap_9
  • h500s_firmware
  • h300s_firmware
  • h610s
  • h410c_firmware
  • h700s
  • h610s_firmware
  • 500f
  • h615c
  • ontap_tools
  • c250_firmware
  • active_iq_unified_manager
  • bootstrap_os
  • hci_compute_node
  • h410s
  • c250
  • h410s_firmware
  • h610c_firmware
  • a250
  • 500f_firmware
  • h410c
  • ontap_select_deploy_administration_utility
  • h615c_firmware
  • h610c
  • management_services_for_element_software_and_netapp_hci
  • h700s_firmware
  • h300s

openssl

  • openssl
CWE
CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')