CVE-2020-1967

Katalog CVE

CVSS 7.5 · High EPSS 53,3%

Kerentanan NULL Pointer Dereference pada openssl, debian linux +24 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).

Rincian

Terbit di NVD

21 April 2020

Terakhir diubah

8 Oktober 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

53,3% peluang dieksploitasi; lebih tinggi dari 98,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.openssl.org/news/secadv/20200421.txt advisory vendor
• https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc patch · advisory pihak ketiga
• https://www.oracle.com//security-alerts/cpujul2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuApr2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujan2021.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2020.html patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuoct2021.html patch · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html mailing list · advisory pihak ketiga
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html mailing list · advisory pihak ketiga
• http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html advisory pihak ketiga · vdb entry
• http://seclists.org/fulldisclosure/2020/May/5 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2020/04/22/2 mailing list · advisory pihak ketiga
• https://github.com/irsl/CVE-2020-1967 exploit · advisory pihak ketiga
• https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440 advisory pihak ketiga
• https://security.gentoo.org/glsa/202004-10 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20200424-0003/ advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20200717-0004/ advisory pihak ketiga
• https://www.debian.org/security/2020/dsa-4661 advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpujul2020.html advisory pihak ketiga
• https://www.synology.com/security/advisory/Synology_SA_20_05 advisory pihak ketiga
• https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL advisory pihak ketiga
• https://www.tenable.com/security/tns-2020-03 advisory pihak ketiga
• https://www.tenable.com/security/tns-2020-04 advisory pihak ketiga
• https://www.tenable.com/security/tns-2020-11 advisory pihak ketiga
• https://www.tenable.com/security/tns-2021-10 advisory pihak ketiga