Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
References
Link Providers
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html cve-icon cve-icon
http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html cve-icon cve-icon
http://seclists.org/fulldisclosure/2020/May/5 cve-icon cve-icon
http://www.openwall.com/lists/oss-security/2020/04/22/2 cve-icon cve-icon
https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1 cve-icon cve-icon
https://github.com/irsl/CVE-2020-1967 cve-icon cve-icon
https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440 cve-icon cve-icon
https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E cve-icon cve-icon
https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/ cve-icon cve-icon
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/ cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2020-1967 cve-icon
https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc cve-icon cve-icon
https://security.gentoo.org/glsa/202004-10 cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20200424-0003/ cve-icon cve-icon
https://security.netapp.com/advisory/ntap-20200717-0004/ cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2020-1967 cve-icon
https://www.debian.org/security/2020/dsa-4661 cve-icon cve-icon
https://www.openssl.org/news/secadv/20200421.txt cve-icon cve-icon cve-icon
https://www.oracle.com//security-alerts/cpujul2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuApr2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujan2021.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpujul2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2020.html cve-icon cve-icon
https://www.oracle.com/security-alerts/cpuoct2021.html cve-icon cve-icon
https://www.synology.com/security/advisory/Synology_SA_20_05 cve-icon cve-icon
https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL cve-icon cve-icon
https://www.tenable.com/security/tns-2020-03 cve-icon cve-icon
https://www.tenable.com/security/tns-2020-04 cve-icon cve-icon
https://www.tenable.com/security/tns-2020-11 cve-icon cve-icon
https://www.tenable.com/security/tns-2021-10 cve-icon cve-icon
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: openssl

Published: 2020-04-21T13:45:15.136203Z

Updated: 2024-09-17T03:13:46.200Z

Reserved: 2019-12-03T00:00:00

Link: CVE-2020-1967

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-04-21T14:15:11.287

Modified: 2024-11-21T05:11:45.023

Link: CVE-2020-1967

cve-icon Redhat

Severity : Important

Publid Date: 2020-04-21T00:00:00Z

Links: CVE-2020-1967 - Bugzilla