Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2020-1967 Details

Description

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html	CVE	Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html	CVE	Mailing ListThird Party Advisory
http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html	CVE	Third Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/May/5	CVE	Mailing ListThird Party Advisory
https://github.com/irsl/CVE-2020-1967	CVE	ExploitThird Party Advisory
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1	CVE
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440	CVE	Third Party Advisory
https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E	CVE
https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E	CVE
https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E	CVE
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/	CVE
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/	CVE
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/	CVE
https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc	CVE	PatchThird Party Advisory
https://security.gentoo.org/glsa/202004-10	CVE	Third Party Advisory
https://security.netapp.com/advisory/ntap-20200424-0003/	CVE	Third Party Advisory
https://security.netapp.com/advisory/ntap-20200717-0004/	CVE	Third Party Advisory
https://www.debian.org/security/2020/dsa-4661	CVE	Third Party Advisory
https://www.openssl.org/news/secadv/20200421.txt	CVE	Vendor Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html	CVE	PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html	CVE	PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html	CVE	Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html	CVE	PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html	CVE	PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html	CVE	PatchThird Party Advisory
https://www.synology.com/security/advisory/Synology_SA_20_05	CVE	Third Party Advisory
https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL	CVE	Third Party Advisory
https://www.tenable.com/security/tns-2020-03	CVE	Third Party Advisory
https://www.tenable.com/security/tns-2020-04	CVE	Third Party Advisory
https://www.tenable.com/security/tns-2020-11	CVE	Third Party Advisory
https://www.tenable.com/security/tns-2021-10	CVE	Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/04/22/2	CVE	Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html	[email protected]	Mailing ListThird Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html	[email protected]	Mailing ListThird Party Advisory
http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html	[email protected]	Third Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2020/May/5	[email protected]	Mailing ListThird Party Advisory
https://github.com/irsl/CVE-2020-1967	[email protected]	ExploitThird Party Advisory
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1	[email protected]
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440	[email protected]	Third Party Advisory
https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E	[email protected]
https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E	[email protected]
https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E	[email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/	[email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/	[email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/	[email protected]
https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc	[email protected]	PatchThird Party Advisory
https://security.gentoo.org/glsa/202004-10	[email protected]	Third Party Advisory
https://security.netapp.com/advisory/ntap-20200424-0003/	[email protected]	Third Party Advisory
https://security.netapp.com/advisory/ntap-20200717-0004/	[email protected]	Third Party Advisory
https://www.debian.org/security/2020/dsa-4661	[email protected]	Third Party Advisory
https://www.openssl.org/news/secadv/20200421.txt	[email protected]	Vendor Advisory
https://www.oracle.com/security-alerts/cpuApr2021.html	[email protected]	PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujan2021.html	[email protected]	PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpujul2020.html	[email protected]	Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html	[email protected]	PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html	[email protected]	PatchThird Party Advisory
https://www.oracle.com/security-alerts/cpuoct2021.html	[email protected]	PatchThird Party Advisory
https://www.synology.com/security/advisory/Synology_SA_20_05	[email protected]	Third Party Advisory
https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL	[email protected]	Third Party Advisory
https://www.tenable.com/security/tns-2020-03	[email protected]	Third Party Advisory
https://www.tenable.com/security/tns-2020-04	[email protected]	Third Party Advisory
https://www.tenable.com/security/tns-2020-11	[email protected]	Third Party Advisory
https://www.tenable.com/security/tns-2021-10	[email protected]	Third Party Advisory
http://www.openwall.com/lists/oss-security/2020/04/22/2	[email protected]	Mailing ListThird Party Advisory

see all 64 references

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-476	NULL Pointer Dereference	[email protected]

Affected Products

Product	Versions
openssl openssl	>= 1.1.1d, <= 1.1.1f
CPE cpe:2.3:a:openssl:openssl:::::::: Remediation No remediation found in references.
debian debian linux	9.0 10.0
CPE cpe:2.3:o:debian:debian_linux:9.0:::::::* cpe:2.3:o:debian:debian_linux:10.0:::::::* Remediation No remediation found in references.
freebsd freebsd	12.1 -
CPE cpe:2.3:o:freebsd:freebsd:12.1:-:::::: Remediation No remediation found in references.
fedoraproject fedora	30 31 32
CPE cpe:2.3:o:fedoraproject:fedora:30:::::::* cpe:2.3:o:fedoraproject:fedora:31:::::::* cpe:2.3:o:fedoraproject:fedora:32:::::::* Remediation No remediation found in references.
oracle application server	12.1.3
CPE cpe:2.3:a:oracle:application_server:12.1.3:::::::* Remediation No remediation found in references.
oracle enterprise manager base platform	13.4.0.0
CPE cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:::::::* Remediation No remediation found in references.
oracle enterprise manager for storage management	13.3.0.0 13.4.0.0
CPE cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.3.0.0:::::::* cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:::::::* Remediation No remediation found in references.
oracle enterprise manager ops center	12.4.0
CPE cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:::::::* Remediation No remediation found in references.
oracle http server	12.2.1.4.0
CPE cpe:2.3:a:oracle:http_server:12.2.1.4.0:::::::* Remediation No remediation found in references.
oracle jd edwards world security	a9.4
CPE cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:::::::* Remediation No remediation found in references.
oracle mysql	<= 5.6.48 >= 5.7.0, <= 5.7.30 >= 8.0.0, <= 8.0.20
CPE cpe:2.3:a:oracle:mysql:::::::: Remediation No remediation found in references.
oracle mysql connectors	<= 8.0.20
CPE cpe:2.3:a:oracle:mysql_connectors:::::::: Remediation No remediation found in references.
oracle mysql enterprise monitor	<= 4.0.12 >= 8.0.0, <= 8.0.20
CPE cpe:2.3:a:oracle:mysql_enterprise_monitor:::::::: Remediation No remediation found in references.
oracle mysql workbench	<= 8.0.21
CPE cpe:2.3:a:oracle:mysql_workbench:::::::: Remediation No remediation found in references.
oracle peoplesoft enterprise peopletools	8.56 8.57 8.58 8.59
CPE cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:::::::* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:::::::* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:::::::* cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:::::::* Remediation No remediation found in references.
netapp active iq unified manager	>= 7.3 >= 9.5
CPE cpe:2.3:a:netapp:active_iq_unified_manager::::::windows::* cpe:2.3:a:netapp:active_iq_unified_manager::::::vmware_vsphere::* Remediation No remediation found in references.
netapp e-series performance analyzer	All versions
CPE cpe:2.3:a:netapp:e-series_performance_analyzer:-:::::::* Remediation No remediation found in references.
netapp oncommand insight	All versions
CPE cpe:2.3:a:netapp:oncommand_insight:-:::::::* Remediation No remediation found in references.
netapp oncommand workflow automation	All versions
CPE cpe:2.3:a:netapp:oncommand_workflow_automation:-:::::::* Remediation No remediation found in references.
netapp smi-s provider	All versions
CPE cpe:2.3:a:netapp:smi-s_provider:-:::::::* Remediation No remediation found in references.
netapp snapcenter	All versions
CPE cpe:2.3:a:netapp:snapcenter:-:::::::* Remediation No remediation found in references.
netapp steelstore cloud integrated storage	All versions
CPE cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:::::::* Remediation No remediation found in references.
broadcom fabric operating system	All versions
CPE cpe:2.3:o:broadcom:fabric_operating_system:-:::::::* Remediation No remediation found in references.
opensuse leap	15.1 15.2
CPE cpe:2.3:o:opensuse:leap:15.1:::::::* cpe:2.3:o:opensuse:leap:15.2:::::::* Remediation No remediation found in references.
jdedwards enterpriseone	< 9.2.5.0
CPE cpe:2.3:a:jdedwards:enterpriseone:::::::: Remediation No remediation found in references.
tenable log correlation engine	< 6.0.9
CPE cpe:2.3:a:tenable:log_correlation_engine:::::::: Remediation No remediation found in references.

Change History

40 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Nov 21, 2024	CVE Modified	CVE
May 14, 2024	CVE Modified	[email protected]
Nov 7, 2023	CVE Modified	[email protected]
Dec 10, 2021	Modified Analysis	[email protected]
Oct 20, 2021	CVE Modified	[email protected]
Jul 20, 2021	CVE Modified	[email protected]
Jun 22, 2021	CPE Deprecation Remap	[email protected]
Jun 14, 2021	CVE Modified	[email protected]
Jun 2, 2021	CVE Modified	[email protected]
Feb 9, 2021	Modified Analysis	[email protected]
Jan 20, 2021	CVE Modified	[email protected]
Dec 22, 2020	Modified Analysis	[email protected]
Dec 21, 2020	CVE Modified	[email protected]
Oct 20, 2020	CVE Modified	[email protected]
Aug 18, 2020	CPE Deprecation Remap	[email protected]
Jul 17, 2020	CVE Modified	[email protected]
Jul 15, 2020	CVE Modified	[email protected]
Jul 7, 2020	CVE Modified	[email protected]
Jul 6, 2020	CVE Modified	[email protected]
Jun 3, 2020	CVE Modified	[email protected]
May 10, 2020	CVE Modified	[email protected]
May 9, 2020	CVE Modified	[email protected]
May 4, 2020	CVE Modified	[email protected]
May 1, 2020	CVE Modified	[email protected]
May 1, 2020	CVE Modified	[email protected]
Apr 30, 2020	Initial Analysis	[email protected]
Apr 30, 2020	CVE Modified	[email protected]
Apr 28, 2020	CVE Modified	[email protected]
Apr 26, 2020	CVE Modified	[email protected]
Apr 24, 2020	CVE Modified	[email protected]
Apr 24, 2020	CVE Modified	[email protected]
Apr 23, 2020	CVE Modified	[email protected]
Apr 23, 2020	CVE Modified	[email protected]
Apr 22, 2020	CVE Modified	[email protected]
Apr 22, 2020	CVE Modified	[email protected]
Apr 22, 2020	CVE Modified	[email protected]
Apr 22, 2020	CVE Modified	[email protected]
Apr 21, 2020	CVE Modified	[email protected]
Apr 21, 2020	CVE Modified	[email protected]

CVE-2020-1967 Details

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Affected Products

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

CPE

Remediation

Change History

QUICK INFO