CVE-2020-1967
Segmentation fault in SSL_check_chain
HIGH 7.5
At a glance
- Source
- NVD
- EPSS
- EPSS 53.34 % · percentile 99 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- openssl
- NVD status
- Modified
Description
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
Weaknesses (CWE)
- CWE-476 — NULL Pointer Dereference
References
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc
- https://www.debian.org/security/2020/dsa-4661
- http://www.openwall.com/lists/oss-security/2020/04/22/2
- https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E
- https://security.gentoo.org/glsa/202004-10
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/
- http://seclists.org/fulldisclosure/2020/May/5
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.tenable.com/security/tns-2020-03
- https://www.openssl.org/news/secadv/20200421.txt
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440
- https://security.netapp.com/advisory/ntap-20200424-0003/
- https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL
- https://github.com/irsl/CVE-2020-1967
- http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html
- https://www.synology.com/security/advisory/Synology_SA_20_05
- https://www.tenable.com/security/tns-2020-04
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20200717-0004/
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.tenable.com/security/tns-2020-11
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.tenable.com/security/tns-2021-10
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2021-1780
- GCVE · GCVE-0-2020-1967
CERT-FR advisories
- CERTFR-2026-AVI-0199 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0119 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2021-AVI-804 — Multiples vulnérabilités dans Oracle PeopleSoft · cert.ssi.gouv.fr
- CERTFR-2021-AVI-430 — Multiples vulnérabilités dans Tenable LCE · cert.ssi.gouv.fr
- CERTFR-2020-AVI-840 — Multiples vulnérabilités dans Tenable Tenable.sc · cert.ssi.gouv.fr
- CERTFR-2020-AVI-691 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
- CERTFR-2020-AVI-664 — Multiples vulnérabilités dans Oracle MySQL · cert.ssi.gouv.fr
- CERTFR-2020-AVI-435 — Multiples vulnérabilités dans Oracle MySQL · cert.ssi.gouv.fr
- CERTFR-2020-AVI-333 — Vulnérabilité dans Tenable Nessus Network Monitor · cert.ssi.gouv.fr
- CERTFR-2020-AVI-257 — Multiples vulnérabilités dans GitLab · cert.ssi.gouv.fr
- CERTFR-2020-AVI-249 — Multiples vulnérabilités dans Tenable Nessus · cert.ssi.gouv.fr
- CERTFR-2020-AVI-235 — Vulnérabilité dans OpenSSL · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*≥ 1.1.1d ≤ 1.1.1fcpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:freebsd:freebsd:12.1:-:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*cpe:2.3:a:oracle:application_server:12.1.3:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.3.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*≤ 5.6.48cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*≥ 5.7.0 ≤ 5.7.30cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*≥ 8.0.0 ≤ 8.0.20cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*≤ 8.0.20cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*≤ 4.0.12cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*≥ 8.0.0 ≤ 8.0.20cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*≤ 8.0.21cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*≥ 7.3cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*≥ 9.5cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:*cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*cpe:2.3:a:jdedwards:enterpriseone:*:*:*:*:*:*:*:*< 9.2.5.0cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*< 6.0.9
Affected products
| Product | Versions |
|---|---|
| OpenSSL · OpenSSL | affected Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f) |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |