CVE-2024-6119
| Affected software | 9 products, listed below |
|---|---|
| Severity | 7.5 High CVSS 3.1 2 scores |
| Weakness | CWE-843 |
| Published | 3 Sep 2024 |
| Updated | 17 Jun 2026 |
Description
Issue summary: Applications performing certificate name checks (e.g., TLS
clients checking server certificates) may attempt to read an invalid memory
address resulting in abnormal termination of the application process.
Impact summary: Abnormal termination of an application can a cause a denial of
service.
Applications performing certificate name checks (e.g., TLS clients checking
server certificates) may attempt to read an invalid memory address when
comparing the expected name with an otherName subject alternative name of an
X.509 certificate. This may result in an exception that terminates the
application program.
Note that basic certificate chain validation (signatures, dates, ...) is not
affected, the denial of service can occur only when the application also
specifies an expected DNS name, Email address or IP address.
TLS servers rarely solicit client certificates, and even when they do, they
generally don't perform a name check against a reference identifier (expected
identity), but rather extract the presented identity after checking the
certificate chain. So TLS servers are generally not affected and the severity
of the issue is Moderate.
The FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.
Exploitation status
Forecast only (67% 30-day chance)
No exploit has been reported in the sources we check. EPSS puts this CVE in the top 0.70% of all scored CVEs. That is a model's forecast, not a report of exploitation.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC none indexed
- EPSS 67% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product. |
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
2 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
NVD | Primary | published |
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
CISA-ADP | Secondary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Security Patch Update August 2026 ↗ | CSPU | 2026-Q3 | Oracle Commerce / Forge (OpenSSL) (11.4.0) |
| Oracle Critical Patch Update April 2025 ↗ | CPU | 2025-Q2 | Oracle Communications / Routing (OpenSSL) (4.1.0, 4.2.0) Oracle Communications / Routing (OpenSSL) (9.2.0, 9.3.0, 10.0.0) Oracle JD Edwards / Enterprise Infrastructure SEC (OpenSSL) (9.2.0.0-9.2.9.2) |
| Oracle Critical Patch Update January 2025 ↗ | CPU | 2025-Q1 | Oracle Communications / Configuration (Cryptography) (24.3.0) |
| Oracle Critical Patch Update October 2024 ↗ | CPU | 2024-Q4 | Oracle Database Server / Oracle Database Security (OpenSSL) (23.4-23.5) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle Commerce | Forge (OpenSSL) | 11.4.0 | 11.4.0 |
| Oracle Communications | Configuration (Cryptography) | 24.3.0 | 24.3.0 |
| Oracle Communications | Routing (OpenSSL) | 4.1.0, 4.2.0 | 4.1.0 · 4.2.0 · 9.2.0 · 9.3.0 · 10.0.0 |
| Oracle Database Server | Oracle Database Security (OpenSSL) | 23.4-23.5 | |
| Oracle JD Edwards | Enterprise Infrastructure SEC (OpenSSL) | 9.2.0.0-9.2.9.2 |
Products and versions
19 products, 22 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | netapp | 500f firmware | generic | any version |
| nvd | netapp | a250 firmware | generic | any version |
| nvd | netapp | active iq unified manager | generic | any version |
| nvd | netapp | bootstrap os | generic | any version |
| nvd | netapp | brocade fabric operating system | generic | any version |
| nvd | netapp | c250 firmware | generic | any version |
| nvd | netapp | h300s firmware | generic | any version |
| nvd | netapp | h410c firmware | generic | any version |
| nvd | netapp | h410s firmware | generic | any version |
| nvd | netapp | h500s firmware | generic | any version |
| nvd | netapp | h610c firmware | generic | any version |
| nvd | netapp | h610s firmware | generic | any version |
| nvd | netapp | h615c | generic | any version |
| nvd | netapp | h700s firmware | generic | any version |
| nvd | netapp | management services for element software and netapp hci | generic | any version |
| nvd | netapp | ontap 9 | generic | any version |
| nvd | netapp | ontap select deploy administration utility | generic | any version |
| nvd | netapp | ontap tools | generic | 9 |
| nvd | openssl | openssl | generic | ≥ 3.0.0 and ＜ 3.0.15 · ≥ 3.1.0 and ＜ 3.1.7 · ≥ 3.2.0 and ＜ 3.2.3 · ≥ 3.3.0 and ＜ 3.3.2 |
References
Timeline
Timeline
| Published | 2024-09-03 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |