CVE-2024-29171: Dell BSAFE SSL-J Information Disclosure

CVE-2024-29171 Overview

CVE-2024-29171 is an improper certificate verification vulnerability [CWE-295] affecting Dell BSAFE SSL-J, a Java-based Transport Layer Security (TLS) toolkit used to secure communications in enterprise applications. The flaw exists in versions prior to 6.6 and in versions 7.0 through 7.2. A remote attacker can exploit the weakness to bypass certificate validation checks, leading to information disclosure across encrypted channels that rely on the library.

The vulnerability carries a CVSS 3.1 base score of 7.5 and is reachable over the network without authentication or user interaction. The Exploit Prediction Scoring System (EPSS) probability is 0.092% with a percentile of 25.89.

Critical Impact
Attackers in a network-adjacent position can intercept or manipulate TLS-protected traffic, exposing confidential data exchanged by applications built on Dell BSAFE SSL-J.

Affected Products

Dell BSAFE SSL-J versions prior to 6.6
Dell BSAFE SSL-J version 7.0
Dell BSAFE SSL-J versions 7.1 through 7.2

Discovery Timeline

2025-02-12 - CVE-2024-29171 published to the National Vulnerability Database (NVD)
2025-03-19 - Last updated in NVD database

Technical Details for CVE-2024-29171

Vulnerability Analysis

Dell BSAFE SSL-J provides Java APIs for TLS handshakes, certificate parsing, and cryptographic operations. CVE-2024-29171 stems from improper certificate verification logic within the library. Under specific conditions, the library accepts certificates that should be rejected during the TLS handshake. Applications relying on the library inherit this weakness without code changes on their side.

The confidentiality impact is rated High while integrity and availability are unaffected. This pattern aligns with attacks that observe or relay TLS traffic rather than corrupt it. Because the validation gap is library-wide, every consumer of the affected versions is exposed regardless of the application protocol layered above TLS.

Root Cause

The root cause is incorrect handling of certificate chain validation, mapped to [CWE-295] Improper Certificate Validation. The library fails to enforce one or more checks required by RFC 5280, such as signature validation, trust anchor matching, hostname binding, or chain construction. As a result, malformed or untrusted certificates can satisfy the handshake.

Attack Vector

The attack vector is Network with low complexity and no privileges required. A remote attacker positioned to intercept traffic between a client and a server using BSAFE SSL-J can present a crafted certificate. Because the library does not reject the certificate, the attacker establishes a TLS session that the client treats as trusted, enabling a man-in-the-middle (MITM) condition and disclosure of session contents.

No public proof-of-concept code is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Dell Security Update DSA-2024-221 for vendor-specific technical context.

Detection Methods for CVE-2024-29171

Indicators of Compromise

Unexpected TLS sessions completing successfully with certificates issued by untrusted or unknown certificate authorities.
Application logs showing TLS handshakes that should have failed due to chain validation errors but instead succeeded.
Anomalous outbound TLS connections to hosts presenting self-signed or recently issued certificates that do not match the expected service identity.

Detection Strategies

Inventory Java applications and middleware for bsafe-ssl-j JAR files and verify the version against the fixed releases.
Inspect dependency manifests, including Maven pom.xml and Gradle build files, for references to Dell BSAFE SSL-J prior to 6.6 or in the 7.0 through 7.2 range.
Enable TLS handshake logging in affected applications and review for accepted certificates that fail external validation against the system trust store.

Monitoring Recommendations

Correlate certificate fingerprints observed in TLS sessions with an allowlist of expected issuers for each application.
Forward TLS and application logs to a centralized data lake for retrospective hunting against suspicious certificate authorities.
Monitor egress traffic for TLS connections terminating at unexpected IP addresses or autonomous systems, particularly during off-hours.

How to Mitigate CVE-2024-29171

Immediate Actions Required

Identify all deployments of Dell BSAFE SSL-J across production, staging, and development environments.
Upgrade affected components to a fixed release as specified in the Dell advisory before exposing services to untrusted networks.
Restrict network paths between clients and servers using the library to reduce the opportunity for MITM positioning.

Patch Information

Dell has published remediation guidance in Dell Security Update DSA-2024-221. Upgrade to Dell BSAFE SSL-J 6.6 or later within the 6.x line, or to a fixed release beyond 7.2 in the 7.x line, per the vendor advisory.

Workarounds

Enforce certificate pinning at the application layer where feasible to reject unexpected issuers regardless of library behavior.
Constrain trusted certificate authorities in the JVM truststore (cacerts) to the minimum set required by each application.
Route sensitive traffic through mutually authenticated TLS (mTLS) channels to add an independent validation layer.

bash

# Identify Dell BSAFE SSL-J artifacts on Linux hosts
find / -type f \( -name "sslj-*.jar" -o -name "bsafe-ssl-j*.jar" \) 2>/dev/null

# List the version metadata for a located JAR
unzip -p /path/to/sslj.jar META-INF/MANIFEST.MF | grep -i version