Log in Start free

Vulnerability · Published Apr 21, 2020 · Assigned by openssl

CVE-2020-1967Segmentation fault in SSL_check_chain

High 7.5

In plain English

A high-severity security flaw in OpenSSL from OpenSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 53.3% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)7.5High
Exploit odds (30 days)53.3%top 1.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20openssl1.1.1g-r0ALPINE-CVE-2020-1967
Alpine:v3.21openssl1.1.1g-r0ALPINE-CVE-2020-1967
Alpine:v3.22openssl1.1.1g-r0ALPINE-CVE-2020-1967
Alpine:v3.23openssl1.1.1g-r0ALPINE-CVE-2020-1967
Alpine:v3.24openssl1.1.1g-r0ALPINE-CVE-2020-1967
Debian:12openssl1.1.1g-1DEBIAN-CVE-2020-1967
Debian:13openssl1.1.1g-1DEBIAN-CVE-2020-1967
Debian:14openssl1.1.1g-1DEBIAN-CVE-2020-1967

Affected products (as reported)

VendorProductVersions
OpenSSL OpenSSL Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f)

References