What’s Vulnerable › Vulnerabilities
CVE-2020-1967: Segmentation fault in SSL_check_chain
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 53.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-04-21 · updated 2026-10-08
- Weakness: CWE-476
Description
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
Affected products
- Brocade Fabric OS: all versions
- Debian Linux: 9.0, 10.0
- Fedoraproject Fedora: 30, 31, 32
- FreeBSD: 12.1
- Jdedwards Enterpriseone: before 9.2.5.0 — fixed in 9.2.5.0
- Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: from 7.3; from 9.5
- NetApp E-Series Performance Analyzer: all versions
- OnCommand Insight: all versions
- NetApp OnCommand Workflow Automation: all versions
- NetApp Smi-S Provider: all versions
- NetApp SnapCenter: all versions
- NetApp Steelstore Cloud Integrated Storage: all versions
- OpenSSL: from 1.1.1d through 1.1.1f
- openSUSE Leap: 15.1, 15.2
- Oracle Application Server: 12.1.3
- Oracle Corporation Enterprise Manager Base Platform: 13.4.0.0
- Oracle Enterprise Manager For Storage Management: 13.3.0.0, 13.4.0.0
- Oracle Corporation Enterprise Manager Ops Center: 12.4.0
- Oracle Corporation Oracle HTTP Server: 12.2.1.4.0
- Oracle Jd Edwards World Security: a9.4
- MySQL Server: through 5.6.48; from 5.7.0 through 5.7.30; from 8.0.0 through 8.0.20
- Oracle Mysql Connectors: through 8.0.20
- Oracle Corporation MySQL Enterprise Monitor: through 4.0.12; from 8.0.0 through 8.0.20
- Oracle Corporation MySQL Workbench: through 8.0.21
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.56, 8.57, 8.58, 8.59
- Tenable Log Correlation Engine: before 6.0.9 — fixed in 6.0.9
How to fix
Upgrade to a fixed version: Jdedwards Enterpriseone 9.2.5.0; Tenable Log Correlation Engine 6.0.9. Check the vendor advisory for mitigations.
References
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html
- http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html
- http://seclists.org/fulldisclosure/2020/May/5
- http://www.openwall.com/lists/oss-security/2020/04/22/2
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1
- https://github.com/irsl/CVE-2020-1967
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440
- https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/
Get alerted when CVE-2020-1967 or the next vulnerability affects your stack