Vulnerability Details : CVE-2020-1967

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).

Vulnerability category: Memory CorruptionDenial of service

Published 2020-04-21 14:15:11

Updated 2021-12-10 17:11:07

Source OpenSSL Software Foundation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2020-1967

Probability of exploitation activity in the next 30 days: 9.95%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 94 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2020-1967

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
5.0	MEDIUM	AV:N/AC:L/Au:N/C:N/I:N/A:P	10.0	2.9	nvd@nist.gov
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	nvd@nist.gov
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2020-1967

CWE-476 NULL Pointer Dereference

A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-1967

https://www.tenable.com/security/tns-2020-04

[R1] Nessus Network Monitor 5.11.1 Fixes One Third-party Vulnerability - Security Advisory | Tenable®
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html

Oracle Critical Patch Update Advisory - October 2020
Patch;Third Party Advisory

CVEs referencing this url
https://www.tenable.com/security/tns-2021-10

[R1] LCE 6.0.9 Fixes Multiple Third-party Vulnerabilities - Security Advisory | Tenable®
Third Party Advisory

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html

[security-announce] openSUSE-SU-2020:0945-1: moderate: Security update f
Mailing List;Third Party Advisory
https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064@%3Cdev.tomcat.apache.org%3E

Re: Time for Tomcat Native 1.2.24? - Pony Mail
Mailing List;Third Party Advisory
https://www.synology.com/security/advisory/Synology_SA_20_05

Synology Inc.
Third Party Advisory
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440

Pulse Security Advisory: SA44440 - April 21 2020 OpenSSL Security Advisory
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html

[security-announce] openSUSE-SU-2020:0933-1: moderate: Security update f
Mailing List;Third Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html

Oracle Critical Patch Update Advisory - July 2020
Third Party Advisory

CVEs referencing this url
https://www.tenable.com/security/tns-2020-03

[R1] Nessus Agent 7.6.3 Fixes Multiple Third-party Vulnerabilities - Security Advisory | Tenable®
Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20200717-0004/

July 2020 MySQL Vulnerabilities in NetApp Products | NetApp Product Security
Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345@%3Cdev.tomcat.apache.org%3E

Re: Time for Tomcat Native 1.2.24? - Pony Mail
Mailing List;Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html

Oracle Critical Patch Update Advisory - July 2021
Patch;Third Party Advisory

CVEs referencing this url
https://github.com/irsl/CVE-2020-1967

GitHub - irsl/CVE-2020-1967: Proof of concept exploit about OpenSSL signature_algorithms_cert DoS flaw (CVE-2020-1967)
Exploit;Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/

[SECURITY] Fedora 30 Update: openssl-1.1.1g-1.fc30 - package-announce - Fedora Mailing-Lists
Third Party Advisory

CVEs referencing this url
https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1

git.openssl.org Git - openssl.git/commitdiff
Mailing List;Patch;Vendor Advisory
http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html

OpenSSL signature_algorithms_cert Denial Of Service ≈ Packet Storm
Third Party Advisory;VDB Entry
https://www.openssl.org/news/secadv/20200421.txt

Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/

[SECURITY] Fedora 32 Update: openssl-1.1.1g-1.fc32 - package-announce - Fedora Mailing-Lists
Third Party Advisory

CVEs referencing this url
https://www.debian.org/security/2020/dsa-4661

Debian -- Security Information -- DSA-4661-1 openssl
Third Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html

Oracle Critical Patch Update Advisory - January 2021
Patch;Third Party Advisory

CVEs referencing this url
https://www.oracle.com/security-alerts/cpuApr2021.html

Oracle Critical Patch Update Advisory - April 2021
Patch;Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2020/04/22/2

oss-security - [CVE-2020-1967] OpenSSL 1.1.1d+ Segmentation fault in SSL_check_chain
Mailing List;Third Party Advisory
https://www.tenable.com/security/tns-2020-11

[R1] Tenable.sc 5.17.0 Fixes Multiple Vulnerabilities - Security Advisory | Tenable®
Third Party Advisory

CVEs referencing this url
https://security.gentoo.org/glsa/202004-10

OpenSSL: Multiple vulnerabilities (GLSA 202004-10) — Gentoo security
Third Party Advisory

CVEs referencing this url
https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee@%3Cdev.tomcat.apache.org%3E

Time for Tomcat Native 1.2.24? - Pony Mail
Mailing List;Third Party Advisory
https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc

Patch;Third Party Advisory
http://seclists.org/fulldisclosure/2020/May/5

Full Disclosure: CVE-2020-1967: proving sigalg != NULL
Mailing List;Third Party Advisory
https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL

Synology Inc.
Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html

Oracle Critical Patch Update Advisory - October 2021
Patch;Third Party Advisory

CVEs referencing this url
https://security.netapp.com/advisory/ntap-20200424-0003/

CVE-2020-1967 OpenSSL Vulnerability in NetApp Products | NetApp Product Security
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/

[SECURITY] Fedora 31 Update: openssl-1.1.1g-1.fc31 - package-announce - Fedora Mailing-Lists
Third Party Advisory

CVEs referencing this url

Products affected by CVE-2020-1967

Freebsd » Freebsd » Version: 12.1
cpe:2.3:o:freebsd:freebsd:12.1:-:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Matching versions
Debian » Debian Linux » Version: 10.0
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Matching versions
Oracle » Http Server » Version: 12.2.1.4.0
cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*
Matching versions
Oracle » Application Server » Version: 12.1.3
cpe:2.3:a:oracle:application_server:12.1.3:*:*:*:*:*:*:*
Matching versions
Oracle » Peoplesoft Enterprise Peopletools » Version: 8.56
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*
Matching versions
Oracle » Peoplesoft Enterprise Peopletools » Version: 8.57
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*
Matching versions
Oracle » Peoplesoft Enterprise Peopletools » Version: 8.58
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
Matching versions
Oracle » Peoplesoft Enterprise Peopletools » Version: 8.59
cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql
Versions from including (>=) 5.7.0 and up to, including, (<=) 5.7.30
cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql
Versions from including (>=) 8.0.0 and up to, including, (<=) 8.0.20
cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql
Versions up to, including, (<=) 5.6.48
cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Enterprise Monitor
Versions up to, including, (<=) 4.0.12
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Enterprise Monitor
Versions from including (>=) 8.0.0 and up to, including, (<=) 8.0.20
cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:*
Matching versions
Oracle » Enterprise Manager Ops Center » Version: 12.4.0
cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*
Matching versions
Oracle » Enterprise Manager Base Platform » Version: 13.4.0.0
cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Connectors
Versions up to, including, (<=) 8.0.20
cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:*
Matching versions
Oracle » Mysql Workbench
Versions up to, including, (<=) 8.0.21
cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:*
Matching versions
Oracle » Jd Edwards World Security » Version: A9.4
cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*
Matching versions
Oracle » Enterprise Manager For Storage Management » Version: 13.3.0.0
cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.3.0.0:*:*:*:*:*:*:*
Matching versions
Oracle » Enterprise Manager For Storage Management » Version: 13.4.0.0
cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:*
Matching versions
Openssl » Openssl
Versions from including (>=) 1.1.1d and up to, including, (<=) 1.1.1f
cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Matching versions
Jdedwards » Enterpriseone
Versions before (<) 9.2.5.0
cpe:2.3:a:jdedwards:enterpriseone:*:*:*:*:*:*:*:*
Matching versions
Broadcom » Fabric Operating System » Version: N/A
cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 31
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 32
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Matching versions
Fedoraproject » Fedora » Version: 30
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.1
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
Matching versions
Opensuse » Leap » Version: 15.2
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
Matching versions
Netapp » Oncommand Workflow Automation » Version: N/A
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
Matching versions
Netapp » Oncommand Insight » Version: N/A
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
Matching versions
Netapp » Steelstore Cloud Integrated Storage » Version: N/A
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
Matching versions
Netapp » Snapcenter » Version: N/A
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
Matching versions
Netapp » Smi-s Provider » Version: N/A
cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*
Matching versions
Netapp » Active Iq Unified Manager » For Windows
Versions from including (>=) 7.3
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:*
Matching versions
Netapp » Active Iq Unified Manager » For Vmware Vsphere
Versions from including (>=) 9.5
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*
Matching versions
Netapp » E-series Performance Analyzer » Version: N/A
cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:*
Matching versions
Tenable » Log Correlation Engine
Versions before (<) 6.0.9
cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*
Matching versions