Home > Vulnerability Database > CVE-2020-1967

Mend.io Vulnerability Database

CVE-2020-1967

Good to know:

Date: April 21, 2020

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).

Language: C

Severity Score

7.5

Related Resources (37)

Url: https://security.netapp.com/advisory/ntap-20200424-0003/

Url: https://www.oracle.com/security-alerts/cpuApr2021.html

Url: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html

Url: http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html

Url: https://www.oracle.com/security-alerts/cpuoct2020.html

Url: https://www.tenable.com/security/tns-2020-11

Url: https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/

Url: https://www.oracle.com/security-alerts/cpujan2021.html

Url: https://security-tracker.debian.org/tracker/CVE-2020-1967

Url: https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440

Url: https://www.synology.com/security/advisory/Synology_SA_20_05

Url: https://www.oracle.com/security-alerts/cpujul2020.html

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/

Url: https://security.netapp.com/advisory/ntap-20200717-0004/

Url: https://www.oracle.com/security-alerts/cpuoct2021.html

Url: https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345@%3Cdev.tomcat.apache.org%3E

Url: http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html

Url: https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc

Url: https://www.tenable.com/security/tns-2021-10

Url: https://www.openssl.org/news/secadv/20200421.txt

Url: https://nvd.nist.gov/vuln/detail/CVE-2020-1967

Url: http://seclists.org/fulldisclosure/2020/May/5

Url: https://www.tenable.com/security/tns-2020-03

Url: https://security.alpinelinux.org/vuln/CVE-2020-1967

Url: https://www.debian.org/security/2020/dsa-4661

Url: https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL

Url: https://www.tenable.com/security/tns-2020-04

Url: http://www.openwall.com/lists/oss-security/2020/04/22/2

Url: https://people.canonical.com/~ubuntu-security/cve/CVE-2020-1967

Url: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/

Url: https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee@%3Cdev.tomcat.apache.org%3E

Url: https://github.com/irsl/CVE-2020-1967

Url: https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064@%3Cdev.tomcat.apache.org%3E

Url: https://www.oracle.com//security-alerts/cpujul2021.html

Url: https://security.gentoo.org/glsa/202004-10

Url: https://www.mend.io/vulnerability-database/CVE-2020-1967

Severity Score

7.5

Weakness Type (CWE)

NULL Pointer Dereference

CWE-476

Top Fix

Upgrade Version

Upgrade to version 1.1.1g

Learn More

CVSS v3.1

Base Score:	7.5
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	LOW
Privileges Required (PR):	NONE
User Interaction (UI):	NONE
Scope (S):	UNCHANGED
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	HIGH

CVSS v2

Base Score:	5.0
Access Vector (AV):	NETWORK
Access Complexity (AC):	LOW
Authentication (AU):	NONE
Confidentiality (C):	NONE
Integrity (I):	NONE
Availability (A):	PARTIAL
Additional information:

Mend.io Vulnerability Database

We found results for “”

CVE-2020-1967

Good to know:

Date: April 21, 2020

Language: C

Severity Score

Related Resources (37)

Severity Score

Weakness Type (CWE)

Top Fix

Upgrade Version

CVSS v3.1

CVSS v2

Do you need more information?