OpenSSL Buffer Overread in CMS Password Decryption (CVE-2024-9143)

CVE-2024-9143 is a buffer overread in OpenSSL's CMS Authenticated Enveloped Data decryption path. Applications calling CMS_decrypt(), CMS_RecipientInfo_decrypt(), or related APIs with malicious CMS messages may crash or leak memory.

Affected OpenSSL branches

• OpenSSL 3.3 before 3.3.2
• OpenSSL 3.2 before 3.2.4
• OpenSSL 3.1 before 3.1.7
• OpenSSL 3.0 before 3.0.15
• OpenSSL 1.1.1 before 1.1.1zb (LTS)

Check installed version

openssl version -a
rpm -q openssl 2>/dev/null || dpkg -l openssl
ldd $(which openssl) | grep ssl

Fix

Upgrade OpenSSL to a fixed release from your distribution or rebuild from upstream patches. Restart services linked against libssl (nginx, postgresql, custom daemons) after updating.

Impact: Medium — primarily affects apps parsing untrusted CMS payloads (mail gateways, custom crypto tools), not typical TLS web traffic alone.