diff --git a/build/openssl/patches-1.0/CVE-2024-0727.patch b/build/openssl/patches-1.0/CVE-2024-0727.patch
new file mode 100644
index 0000000000..ab3b0ad6be
--- /dev/null
+++ b/build/openssl/patches-1.0/CVE-2024-0727.patch
@@ -0,0 +1,110 @@
+From 09df4395b5071217b76dc7d3d2e630eb8c5a79c2 Mon Sep 17 00:00:00 2001
+From: Matt Caswell <matt@openssl.org>
+Date: Fri, 19 Jan 2024 11:28:58 +0000
+Subject: [PATCH] Add NULL checks where ContentInfo data can be NULL
+
+PKCS12 structures contain PKCS7 ContentInfo fields. These fields are
+optional and can be NULL even if the "type" is a valid value. OpenSSL
+was not properly accounting for this and a NULL dereference can occur
+causing a crash.
+
+CVE-2024-0727
+
+Reviewed-by: Tomas Mraz <tomas@openssl.org>
+Reviewed-by: Hugo Landau <hlandau@openssl.org>
+Reviewed-by: Neil Horman <nhorman@openssl.org>
+(Merged from https://github.com/openssl/openssl/pull/23362)
+
+(cherry picked from commit d135eeab8a5dbf72b3da5240bab9ddb7678dbd2c)
+diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_add.c a/crypto/pkcs12/p12_add.c
+--- a~/crypto/pkcs12/p12_add.c	1970-01-01 00:00:00
++++ a/crypto/pkcs12/p12_add.c	1970-01-01 00:00:00
+@@ -171,6 +171,13 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_
+                   PKCS12_R_CONTENT_TYPE_NOT_DATA);
+         return NULL;
+     }
++
++    if (p7->d.data == NULL) {
++        PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA,
++                  PKCS12_R_DECODE_ERROR);
++        return NULL;
++    }
++
+     return ASN1_item_unpack(p7->d.data, ASN1_ITEM_rptr(PKCS12_SAFEBAGS));
+ }
+ 
+@@ -226,6 +233,13 @@ STACK_OF(PKCS12_SAFEBAG) *PKCS12_unpack_
+ {
+     if (!PKCS7_type_is_encrypted(p7))
+         return NULL;
++
++    if (p7->d.encrypted == NULL) {
++        PKCS12err(PKCS12_F_PKCS12_UNPACK_P7DATA,
++                  PKCS12_R_DECODE_ERROR);
++        return NULL;
++    }
++
+     return PKCS12_item_decrypt_d2i(p7->d.encrypted->enc_data->algorithm,
+                                    ASN1_ITEM_rptr(PKCS12_SAFEBAGS),
+                                    pass, passlen,
+@@ -253,6 +267,13 @@ STACK_OF(PKCS7) *PKCS12_unpack_authsafes
+                   PKCS12_R_CONTENT_TYPE_NOT_DATA);
+         return NULL;
+     }
++
++    if (p12->authsafes->d.data == NULL) {
++        PKCS12err(PKCS12_F_PKCS12_UNPACK_AUTHSAFES,
++                  PKCS12_R_DECODE_ERROR);
++        return NULL;
++    }
++
+     return ASN1_item_unpack(p12->authsafes->d.data,
+                             ASN1_ITEM_rptr(PKCS12_AUTHSAFES));
+ }
+diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_mutl.c a/crypto/pkcs12/p12_mutl.c
+--- a~/crypto/pkcs12/p12_mutl.c	1970-01-01 00:00:00
++++ a/crypto/pkcs12/p12_mutl.c	1970-01-01 00:00:00
+@@ -80,6 +80,11 @@ int PKCS12_gen_mac(PKCS12 *p12, const ch
+         return 0;
+     }
+ 
++    if (p12->authsafes->d.data == NULL) {
++        PKCS12err(PKCS12_F_PKCS12_GEN_MAC, PKCS12_R_DECODE_ERROR);
++        return 0;
++    }
++
+     salt = p12->mac->salt->data;
+     saltlen = p12->mac->salt->length;
+     if (!p12->mac->iter)
+diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs12/p12_npas.c a/crypto/pkcs12/p12_npas.c
+--- a~/crypto/pkcs12/p12_npas.c	1970-01-01 00:00:00
++++ a/crypto/pkcs12/p12_npas.c	1970-01-01 00:00:00
+@@ -126,7 +126,8 @@ static int newpass_p12(PKCS12 *p12, cons
+             bags = PKCS12_unpack_p7data(p7);
+         } else if (bagnid == NID_pkcs7_encrypted) {
+             bags = PKCS12_unpack_p7encdata(p7, oldpass, -1);
+-            if (!alg_get(p7->d.encrypted->enc_data->algorithm,
++            if (p7->d.encrypted == NULL
++                    || !alg_get(p7->d.encrypted->enc_data->algorithm,
+                          &pbe_nid, &pbe_iter, &pbe_saltlen))
+                 goto err;
+         } else {
+diff -wpruN --no-dereference '--exclude=*.orig' a~/crypto/pkcs7/pk7_mime.c a/crypto/pkcs7/pk7_mime.c
+--- a~/crypto/pkcs7/pk7_mime.c	1970-01-01 00:00:00
++++ a/crypto/pkcs7/pk7_mime.c	1970-01-01 00:00:00
+@@ -78,10 +78,13 @@ int SMIME_write_PKCS7(BIO *bio, PKCS7 *p
+ {
+     STACK_OF(X509_ALGOR) *mdalgs;
+     int ctype_nid = OBJ_obj2nid(p7->type);
+-    if (ctype_nid == NID_pkcs7_signed)
++    if (ctype_nid == NID_pkcs7_signed) {
++	if (p7->d.sign == NULL)
++		return 0;
+         mdalgs = p7->d.sign->md_algs;
+-    else
++    } else {
+         mdalgs = NULL;
++    }
+ 
+     flags ^= SMIME_OLDMIME;
+ 
diff --git a/build/openssl/patches-1.0/series b/build/openssl/patches-1.0/series
index 461f3080f3..705c2ca349 100644
--- a/build/openssl/patches-1.0/series
+++ b/build/openssl/patches-1.0/series
@@ -19,3 +19,4 @@ CVE-2023-0465.patch
 CVE-2023-2650.patch
 CVE-2023-3446.patch
 CVE-2023-3817.patch
+CVE-2024-0727.patch