Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-1967

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).

Published

2020-04-21T14:15:11.287

Last Modified

2024-11-21T05:11:45.023

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

2.9

Weaknesses
  • Type: Primary
    CWE-476
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application openssl openssl ≤ 1.1.1f Yes
Operating System debian debian_linux 9.0 Yes
Operating System debian debian_linux 10.0 Yes
Operating System freebsd freebsd 12.1 Yes
Operating System fedoraproject fedora 30 Yes
Operating System fedoraproject fedora 31 Yes
Operating System fedoraproject fedora 32 Yes
Application oracle application_server 12.1.3 Yes
Application oracle enterprise_manager_base_platform 13.4.0.0 Yes
Application oracle enterprise_manager_for_storage_management 13.3.0.0 Yes
Application oracle enterprise_manager_for_storage_management 13.4.0.0 Yes
Application oracle enterprise_manager_ops_center 12.4.0 Yes
Application oracle http_server 12.2.1.4.0 Yes
Application oracle jd_edwards_world_security a9.4 Yes
Application oracle mysql ≤ 5.6.48 Yes
Application oracle mysql ≤ 5.7.30 Yes
Application oracle mysql ≤ 8.0.20 Yes
Application oracle mysql_connectors ≤ 8.0.20 Yes
Application oracle mysql_enterprise_monitor ≤ 4.0.12 Yes
Application oracle mysql_enterprise_monitor ≤ 8.0.20 Yes
Application oracle mysql_workbench ≤ 8.0.21 Yes
Application oracle peoplesoft_enterprise_peopletools 8.56 Yes
Application oracle peoplesoft_enterprise_peopletools 8.57 Yes
Application oracle peoplesoft_enterprise_peopletools 8.58 Yes
Application oracle peoplesoft_enterprise_peopletools 8.59 Yes
Application netapp active_iq_unified_manager ≥ 7.3 Yes
Application netapp active_iq_unified_manager ≥ 9.5 Yes
Application netapp e-series_performance_analyzer - Yes
Application netapp oncommand_insight - Yes
Application netapp oncommand_workflow_automation - Yes
Application netapp smi-s_provider - Yes
Application netapp snapcenter - Yes
Application netapp steelstore_cloud_integrated_storage - Yes
Operating System broadcom fabric_operating_system - Yes
Operating System opensuse leap 15.1 Yes
Operating System opensuse leap 15.2 Yes
Application jdedwards enterpriseone < 9.2.5.0 Yes
Application tenable log_correlation_engine < 6.0.9 Yes
References