CVE-2020-1967
HIGHCVSS 7.5/10EPSS 53.34%
Last modified
CVE-2020-1967 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. EPSS estimates a 53.34% chance of exploitation in the next 30 days.
Description
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openssl | Openssl | >= 1.1.1d, <= 1.1.1f |
| Debian | Debian Linux | 9.0 |
| Debian | Debian Linux | 10.0 |
| Freebsd | Freebsd | 12.1 |
| Fedoraproject | Fedora | 30 |
| Fedoraproject | Fedora | 31 |
| Fedoraproject | Fedora | 32 |
| Oracle | Application Server | 12.1.3 |
| Oracle | Enterprise Manager Base Platform | 13.4.0.0 |
| Oracle | Enterprise Manager For Storage Management | 13.3.0.0 |
| Oracle | Enterprise Manager For Storage Management | 13.4.0.0 |
| Oracle | Enterprise Manager Ops Center | 12.4.0 |
| Oracle | Http Server | 12.2.1.4.0 |
| Oracle | Jd Edwards World Security | a9.4 |
| Oracle | Mysql | <= 5.6.48 |
| Oracle | Mysql | >= 5.7.0, <= 5.7.30 |
| Oracle | Mysql | >= 8.0.0, <= 8.0.20 |
| Oracle | Mysql Connectors | <= 8.0.20 |
| Oracle | Mysql Enterprise Monitor | <= 4.0.12 |
| Oracle | Mysql Enterprise Monitor | >= 8.0.0, <= 8.0.20 |
| Oracle | Mysql Workbench | <= 8.0.21 |
| Oracle | Peoplesoft Enterprise Peopletools | 8.56 |
| Oracle | Peoplesoft Enterprise Peopletools | 8.57 |
| Oracle | Peoplesoft Enterprise Peopletools | 8.58 |
| Oracle | Peoplesoft Enterprise Peopletools | 8.59 |
| Netapp | Active Iq Unified Manager | >= 7.3 |
| Netapp | Active Iq Unified Manager | >= 9.5 |
| Netapp | E-Series Performance Analyzer | All versions |
| Netapp | Oncommand Insight | All versions |
| Netapp | Oncommand Workflow Automation | All versions |
| Netapp | Smi-S Provider | All versions |
| Netapp | Snapcenter | All versions |
| Netapp | Steelstore Cloud Integrated Storage | All versions |
| Broadcom | Fabric Operating System | All versions |
| Opensuse | Leap | 15.1 |
| Opensuse | Leap | 15.2 |
| Jdedwards | Enterpriseone | < 9.2.5.0 |
| Tenable | Log Correlation Engine | < 6.0.9 |
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.htmlMailing List, Third Party Advisory
- http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.htmlThird Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/May/5Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2020/04/22/2Mailing List, Third Party Advisory
- https://github.com/irsl/CVE-2020-1967Exploit, Third Party Advisory
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440Third Party Advisory
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.ascPatch, Third Party Advisory
- https://security.gentoo.org/glsa/202004-10Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200424-0003/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200717-0004/Third Party Advisory
- https://www.debian.org/security/2020/dsa-4661Third Party Advisory
- https://www.openssl.org/news/secadv/20200421.txtVendor Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
- https://www.synology.com/security/advisory/Synology_SA_20_05Third Party Advisory
- https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSLThird Party Advisory
- https://www.tenable.com/security/tns-2020-03Third Party Advisory
- https://www.tenable.com/security/tns-2020-04Third Party Advisory
- https://www.tenable.com/security/tns-2020-11Third Party Advisory
- https://www.tenable.com/security/tns-2021-10Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.htmlMailing List, Third Party Advisory
- http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.htmlThird Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2020/May/5Mailing List, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2020/04/22/2Mailing List, Third Party Advisory
- https://github.com/irsl/CVE-2020-1967Exploit, Third Party Advisory
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440Third Party Advisory
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.ascPatch, Third Party Advisory
- https://security.gentoo.org/glsa/202004-10Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200424-0003/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200717-0004/Third Party Advisory
- https://www.debian.org/security/2020/dsa-4661Third Party Advisory
- https://www.openssl.org/news/secadv/20200421.txtVendor Advisory
- https://www.oracle.com//security-alerts/cpujul2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujan2021.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2020.htmlThird Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2020.htmlPatch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.htmlPatch, Third Party Advisory
- https://www.synology.com/security/advisory/Synology_SA_20_05Third Party Advisory
- https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSLThird Party Advisory
- https://www.tenable.com/security/tns-2020-03Third Party Advisory
- https://www.tenable.com/security/tns-2020-04Third Party Advisory
- https://www.tenable.com/security/tns-2020-11Third Party Advisory
- https://www.tenable.com/security/tns-2021-10Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-1967?
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
How severe is CVE-2020-1967?
CVE-2020-1967 has a CVSS score of 7.5/10 (HIGH severity). The EPSS model estimates a 53.34% probability of exploitation in the next 30 days.
How do I fix CVE-2020-1967?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-1966Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-19660Cross Site Scripting (XSS) pandao editor.md 1.5.0 allows att…6.1
- CVE-2020-19664DrayTek Vigor2960 1.5.1 allows remote command execution via …8.8
- CVE-2020-19667Stack-based buffer overflow and unconditional jump in ReadXP…7.8
- CVE-2020-19668Unverified indexs into the array lead to out of bound access…6.5
- CVE-2020-19669Cross Site Request Forgery (CSRF) vulnerability exists in Ey…8.8
- CVE-2020-19670In Niushop B2B2C Multi-Business Basic Edition V1.11, authent…4.9
- CVE-2020-19672Niushop B2B2C Multi-business basic version V1.11, can bypass…9.8
- CVE-2020-19676Nacos 1.1.4 is affected by: Incorrect Access Control. An env…5.3
- CVE-2020-19678Directory Traversal vulnerability found in Pfsense v.2.1.3 a…7.5
- CVE-2020-1968The Raccoon attack exploits a flaw in the TLS specification …3.7
- CVE-2020-19682A Cross Site Request Forgery (CSRF) vulnerability exits in Z…8.8
Are you affected by CVE-2020-1967?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST