CVE-2024-4741

A use-after-free vulnerability was found in OpenSSL. Calling the OpenSSL API SSL_free_buffers function may cause memory to be accessed that was previously freed in some situations.

This vulnerability is classified as low severity rather than moderate because it only affects applications that explicitly call SSL_free_buffers, a rarely used OpenSSL function.

The issue arises in specific conditions where the function is called while a buffer is still in use, leading to a potential use-after-free scenario. However, exploitation is significantly constrained because

(1) an application must intentionally invoke this function, which is not typical in common OpenSSL usage,

(2) triggering the vulnerability requires precise timing and conditions where partially processed records remain unread or incomplete, and

(3) there are no known active exploits leveraging this issue.

Given these factors, while the bug could theoretically lead to crashes or corruption, the practical risk of widespread exploitation remains minimal.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.