{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2020-1971", "assignerOrgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "assignerShortName": "openssl", "dateUpdated": "2024-09-17T02:57:20.238Z", "dateReserved": "2019-12-03T00:00:00", "datePublished": "2020-12-08T15:30:16.835255Z"}, "containers": {"cna": {"title": "EDIPARTYNAME NULL pointer dereference", "datePublic": "2020-12-08T00:00:00", "providerMetadata": {"orgId": "3a12439a-ef3a-4c79-92e6-6081a721f1e5", "shortName": "openssl", "dateUpdated": "2024-06-21T19:06:11.147749"}, "descriptions": [{"lang": "en", "value": "The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w)."}], "affected": [{"vendor": "OpenSSL", "product": "OpenSSL", "versions": [{"version": "Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h)", "status": "affected"}, {"version": "Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w)", "status": "affected"}]}], "references": [{"url": "https://www.openssl.org/news/secadv/20201208.txt"}, {"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920"}, {"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e"}, {"name": "DSA-4807", "tags": ["vendor-advisory"], "url": "https://www.debian.org/security/2020/dsa-4807"}, {"name": "FreeBSD-SA-20:33", "tags": ["vendor-advisory"], "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc"}, {"name": "[debian-lts-announce] 20201214 [SECURITY] [DLA 2493-1] openssl1.0 security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html"}, {"name": "[debian-lts-announce] 20201214 [SECURITY] [DLA 2492-1] openssl security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html"}, {"name": "FEDORA-2020-ef1870065a", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/"}, {"name": "[pulsar-commits] 20201216 [GitHub] [pulsar] phijohns-tibco opened a new issue #8978: OpenSSL needs to be updated to 1.1.1i current version is unsupported.", "tags": ["mailing-list"], "url": "https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E"}, {"name": "FEDORA-2020-a31b01e945", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/"}, {"name": "GLSA-202012-13", "tags": ["vendor-advisory"], "url": "https://security.gentoo.org/glsa/202012-13"}, {"url": "https://www.oracle.com/security-alerts/cpujan2021.html"}, {"url": "https://www.tenable.com/security/tns-2020-11"}, {"url": "https://security.netapp.com/advisory/ntap-20201218-0005/"}, {"url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676"}, {"name": "[tomcat-dev] 20210207 [Bug 65126] New: A security vulnerability cve-2020-1971 in Tomcat dependency Library in version 9.0.40.", "tags": ["mailing-list"], "url": "https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E"}, {"url": "https://www.oracle.com/security-alerts/cpuApr2021.html"}, {"url": "https://www.tenable.com/security/tns-2021-10"}, {"url": "https://www.tenable.com/security/tns-2021-09"}, {"url": "https://security.netapp.com/advisory/ntap-20210513-0002/"}, {"url": "https://www.oracle.com//security-alerts/cpujul2021.html"}, {"name": "[oss-security] 20210914 Re: Oracle Solaris membership in the distros list", "tags": ["mailing-list"], "url": "http://www.openwall.com/lists/oss-security/2021/09/14/2"}, {"url": "https://www.oracle.com/security-alerts/cpuoct2021.html"}, {"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"}, {"url": "https://security.netapp.com/advisory/ntap-20240621-0006/"}], "credits": [{"lang": "en", "value": "David Benjamin (Google)"}], "metrics": [{"other": {"content": {"lang": "eng", "url": "https://www.openssl.org/policies/secpolicy.html#High", "value": "High"}, "type": "unknown"}}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "NULL pointer dereference"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T06:54:00.529Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.openssl.org/news/secadv/20201208.txt", "tags": ["x_transferred"]}, {"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920", "tags": ["x_transferred"]}, {"url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e", "tags": ["x_transferred"]}, {"name": "DSA-4807", "tags": ["vendor-advisory", "x_transferred"], "url": "https://www.debian.org/security/2020/dsa-4807"}, {"name": "FreeBSD-SA-20:33", "tags": ["vendor-advisory", "x_transferred"], "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc"}, {"name": "[debian-lts-announce] 20201214 [SECURITY] [DLA 2493-1] openssl1.0 security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html"}, {"name": "[debian-lts-announce] 20201214 [SECURITY] [DLA 2492-1] openssl security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html"}, {"name": "FEDORA-2020-ef1870065a", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/"}, {"name": "[pulsar-commits] 20201216 [GitHub] [pulsar] phijohns-tibco opened a new issue #8978: OpenSSL needs to be updated to 1.1.1i current version is unsupported.", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E"}, {"name": "FEDORA-2020-a31b01e945", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/"}, {"name": "GLSA-202012-13", "tags": ["vendor-advisory", "x_transferred"], "url": "https://security.gentoo.org/glsa/202012-13"}, {"url": "https://www.oracle.com/security-alerts/cpujan2021.html", "tags": ["x_transferred"]}, {"url": "https://www.tenable.com/security/tns-2020-11", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20201218-0005/", "tags": ["x_transferred"]}, {"url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676", "tags": ["x_transferred"]}, {"name": "[tomcat-dev] 20210207 [Bug 65126] New: A security vulnerability cve-2020-1971 in Tomcat dependency Library in version 9.0.40.", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E"}, {"url": "https://www.oracle.com/security-alerts/cpuApr2021.html", "tags": ["x_transferred"]}, {"url": "https://www.tenable.com/security/tns-2021-10", "tags": ["x_transferred"]}, {"url": "https://www.tenable.com/security/tns-2021-09", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20210513-0002/", "tags": ["x_transferred"]}, {"url": "https://www.oracle.com//security-alerts/cpujul2021.html", "tags": ["x_transferred"]}, {"name": "[oss-security] 20210914 Re: Oracle Solaris membership in the distros list", "tags": ["mailing-list", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2021/09/14/2"}, {"url": "https://www.oracle.com/security-alerts/cpuoct2021.html", "tags": ["x_transferred"]}, {"url": "https://www.oracle.com/security-alerts/cpuapr2022.html", "tags": ["x_transferred"]}, {"url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240621-0006/", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "4D0947DA-4A07-4C73-9FE7-7666734C568B", "versionEndExcluding": "1.0.2x", "versionStartIncluding": "1.0.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*", "matchCriteriaId": "BFE3E95C-90F0-48C0-A737-28AD6AC2BDB8", "versionEndExcluding": "1.1.1i", "versionStartIncluding": "1.1.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "matchCriteriaId": "DEECE5FC-CACF-4496-A3E7-164736409252", "vulnerable": true}, {"criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*", "matchCriteriaId": "36D96259-24BD-44E2-96D9-78CE1D41F956", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*", "matchCriteriaId": "E460AA51-FCDA-46B9-AE97-E6676AA5E194", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:oracle:api_gateway:11.1.2.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "A5553591-073B-45E3-999F-21B8BA2EEE22", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:business_intelligence:5.5.0.0.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "D40AD626-B23A-44A3-A6C0-1FFB4D647AE4", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "B602F9E8-1580-436C-A26D-6E6F8121A583", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:business_intelligence:12.2.1.3.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "77C3DD16-1D81-40E1-B312-50FBD275507C", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:business_intelligence:12.2.1.4.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "81DAC8C0-D342-44B5-9432-6B88D389584F", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:communications_cloud_native_core_network_function_cloud_native_environment:1.10.0:*:*:*:*:*:*:*", "matchCriteriaId": "C2A5B24D-BDF2-423C-98EA-A40778C01A05", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*", "matchCriteriaId": "B5B4A191-44AE-4C35-9164-19237D2CF013", "versionEndIncluding": "8.1.0", "versionStartIncluding": "8.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:communications_diameter_intelligence_hub:*:*:*:*:*:*:*:*", "matchCriteriaId": "A543B4F8-149A-48AB-B388-AB7FA2ECAC18", "versionEndIncluding": "8.2.3", "versionStartIncluding": "8.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:communications_session_border_controller:cz8.2:*:*:*:*:*:*:*", "matchCriteriaId": "45F90ABB-2633-447C-B510-D63D9898BD67", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:communications_session_border_controller:cz8.3:*:*:*:*:*:*:*", "matchCriteriaId": "22822A0F-A2C4-427A-931F-428D2C010ECD", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:communications_session_border_controller:cz8.4:*:*:*:*:*:*:*", "matchCriteriaId": "62A561CF-09BE-4EDB-AAB7-4B057C0B0E44", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:communications_session_router:cz8.2:*:*:*:*:*:*:*", "matchCriteriaId": "58E8C3A9-1B8B-4D13-B0E9-DC620F619DD9", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:communications_session_router:cz8.3:*:*:*:*:*:*:*", "matchCriteriaId": "5C880943-5A11-483E-9DA8-88D1D487BAA4", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:communications_session_router:cz8.4:*:*:*:*:*:*:*", "matchCriteriaId": "ECF63433-30CC-4E0D-B66A-FD160111763B", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.2:*:*:*:*:*:*:*", "matchCriteriaId": "662B8154-6FFA-4B63-B5AD-18B1CECB3AF6", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.3:*:*:*:*:*:*:*", "matchCriteriaId": "5F2BFCE3-D743-4AC6-8FEC-75CAF66BFB65", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:communications_subscriber-aware_load_balancer:cz8.4:*:*:*:*:*:*:*", "matchCriteriaId": "B8D05530-BFC7-4652-B387-BC931F43AB5B", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:communications_unified_session_manager:scz8.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "A200B074-61AF-4E1D-8F96-A73BECF81BC4", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.1:*:*:*:*:*:*:*", "matchCriteriaId": "83739D8B-EAA0-43CD-B0EB-278C2F65CA42", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.2:*:*:*:*:*:*:*", "matchCriteriaId": "2D3AD28E-4372-4B22-A0B9-B9BA7760E381", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:enterprise_communications_broker:pcz3.3:*:*:*:*:*:*:*", "matchCriteriaId": "4B317147-064A-4786-B3D6-CDE1653E067E", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.3.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "7582B307-3899-4BBB-B868-BC912A4D0109", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "D26F3E23-F1A9-45E7-9E5F-0C0A24EE3783", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "61516569-C48F-4362-B334-8CA10EDB0EC2", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "B095CC03-7077-4A58-AB25-CC5380CDCE5A", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.2:*:*:*:*:*:*:*", "matchCriteriaId": "EC124081-4465-4A80-897A-1DAC1013915E", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.3:*:*:*:*:*:*:*", "matchCriteriaId": "B2AFC7C4-9FCC-425B-A010-F9EA0665753F", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:enterprise_session_border_controller:cz8.4:*:*:*:*:*:*:*", "matchCriteriaId": "FC109637-7BCA-4E9D-AC51-48D488E17E2B", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:*", "matchCriteriaId": "394A16F2-CCD4-44E5-BF6B-E0C782A9FA38", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:graalvm:19.3.4:*:*:*:enterprise:*:*:*", "matchCriteriaId": "937F66F5-F5BA-4156-82E0-EB2C99ABD41A", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:graalvm:20.3.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "BC0F8B31-F93B-40B6-9C06-A3996DC63829", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "AD04BEE5-E9A8-4584-A68C-0195CE9C402C", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*", "matchCriteriaId": "4BCA7DD9-8599-4E43-9D82-999BE15483B9", "versionEndExcluding": "9.2.5.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:*", "matchCriteriaId": "0B1CAD50-749F-4ADB-A046-BF3585677A58", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:*", "matchCriteriaId": "16DEEDB2-E304-41A3-97DB-EDDFB16BE624", "versionEndIncluding": "8.0.22", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "B4335442-548B-48AB-A399-DB146C6A8705", "versionEndIncluding": "5.7.32", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "B7EAD39D-A892-4667-89D9-F66A33EAF9B7", "versionEndIncluding": "8.0.22", "versionStartIncluding": "8.0.15", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*", "matchCriteriaId": "D0A735B4-4F3C-416B-8C08-9CB21BAD2889", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*", "matchCriteriaId": "7E1E416B-920B-49A0-9523-382898C2979D", "vulnerable": true}, {"criteria": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*", "matchCriteriaId": "D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*", "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*", "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*", "matchCriteriaId": "62347994-1353-497C-9C4A-D5D8D95F67E8", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:data_ontap:-:*:*:*:*:7-mode:*:*", "matchCriteriaId": "6C2ACC32-5147-4EA5-95BE-B6B4EAB3D82B", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*", "matchCriteriaId": "BD1E9594-C46F-40D1-8BC2-6B16635B55C4", "versionEndIncluding": "11.60.3", "versionStartIncluding": "11.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*", "matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:manageability_software_development_kit:-:*:*:*:*:*:*:*", "matchCriteriaId": "D39DCAE7-494F-40B2-867F-6C6A077939DD", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*", "matchCriteriaId": "F1BE6C1F-2565-4E97-92AA-16563E5660A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*", "matchCriteriaId": "5735E553-9731-4AAC-BCFF-989377F817B3", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:plug-in_for_symantec_netbackup:-:*:*:*:*:*:*:*", "matchCriteriaId": "FFE0A9D2-9A49-4BF6-BC6F-8249162D8334", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*", "matchCriteriaId": "361B791A-D336-4431-8F68-8135BEFFAEA2", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*", "matchCriteriaId": "BDFB1169-41A0-4A86-8E4F-FDA9730B1E94", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*", "matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737", "vulnerable": true}, {"criteria": "cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*", "matchCriteriaId": "AD7447BC-F315-4298-A822-549942FC118B", "vulnerable": true}, {"criteria": "cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*", "matchCriteriaId": "02DEB4FB-A21D-4CB1-B522-EEE5093E8521", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netapp:ef600a_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "5356D8E0-38AB-44F2-BA0A-F884C92222D1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netapp:ef600a:-:*:*:*:*:*:*:*", "matchCriteriaId": "44824034-DB0C-47AC-A32F-1EA373F30A61", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:netapp:aff_a250_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "0D5DE972-F8B8-4964-943A-DA0BD18289D1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:netapp:aff_a250:-:*:*:*:*:*:*:*", "matchCriteriaId": "D4B1F59C-6ADA-4930-834F-2A8A8444F6AE", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*", "matchCriteriaId": "4ACF85D6-6B45-43DA-9C01-F0208186F014", "versionEndExcluding": "6.0.9", "vulnerable": true}, {"criteria": "cpe:2.3:a:tenable:nessus_network_monitor:*:*:*:*:*:*:*:*", "matchCriteriaId": "A87E730E-019C-4DCB-BA73-3994ECEF0C66", "versionEndExcluding": "5.13.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*", "matchCriteriaId": "B0F46497-4AB0-49A7-9453-CC26837BF253", "versionEndExcluding": "1.0.1.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "25A3180B-21AF-4010-9DAB-41ADFD2D8031", "versionEndIncluding": "10.12.0", "versionStartIncluding": "10.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "matchCriteriaId": "33081E31-5166-4064-91AA-951F5CD930D3", "versionEndExcluding": "10.23.1", "versionStartIncluding": "10.13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "564ED5C8-50D7-413A-B88E-E62B6C07336A", "versionEndIncluding": "12.12.0", "versionStartIncluding": "12.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "matchCriteriaId": "58879E00-2C36-4C1B-9993-2422346624D3", "versionEndExcluding": "12.20.1", "versionStartIncluding": "12.13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "428DCD7B-6F66-4F18-B780-5BD80143D482", "versionEndIncluding": "14.14.0", "versionStartIncluding": "14.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:lts:*:*:*", "matchCriteriaId": "2F2D8EEB-7A9E-472A-B820-A3C33CB93B61", "versionEndExcluding": "14.15.4", "versionStartIncluding": "14.15.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:nodejs:node.js:*:*:*:*:-:*:*:*", "matchCriteriaId": "1A868E7E-C25A-4B2A-BB37-7F2584ECB2D4", "versionEndExcluding": "15.5.0", "versionStartIncluding": "15.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w)."}, {"lang": "es", "value": "El tipo GeneralName X.509 es un tipo gen\u00e9rico para representar diferentes tipos de nombres. Uno de esos tipos de nombres se conoce como EDIPartyName. OpenSSL proporciona una funci\u00f3n GENERAL_NAME_cmp que compara diferentes instancias de GENERAL_NAME para ver si son iguales o no. Esta funci\u00f3n se comporta incorrectamente cuando ambos GENERAL_NAME contienen un EDIPARTYNAME. Es posible que se produzca una desreferencia del puntero NULL y un bloqueo que conduzca a un posible ataque de denegaci\u00f3n de servicio. El propio OpenSSL usa la funci\u00f3n GENERAL_NAME_cmp para dos prop\u00f3sitos: 1) Comparaci\u00f3n de nombres de puntos de distribuci\u00f3n de CRL entre una CRL disponible y un punto de distribuci\u00f3n de CRL insertado en un certificado X509 2) Al comparar que un firmante de token de respuesta de marca de tiempo coincide con el nombre de autoridad de marca de tiempo (expuesto por medio de las funciones API TS_RESP_verify_response y TS_RESP_verify_token) Si un atacante puede controlar ambos elementos que se est\u00e1n comparando, entonces ese atacante podr\u00eda desencadenar un bloqueo. Por ejemplo, si el atacante puede enga\u00f1ar a un cliente o servidor para que compruebe un certificado malicioso con una CRL maliciosa, esto puede ocurrir. Tome en cuenta que algunas aplicaciones descargan autom\u00e1ticamente las CRL basadas en una URL insertada en un certificado. Esta comprobaci\u00f3n ocurre antes de que se verifiquen las firmas en el certificado y la CRL. Las herramientas s_server, s_client y verify de OpenSSL tienen soporte para la opci\u00f3n \"-crl_download\" que implementa la descarga autom\u00e1tica de CRL y se ha demostrado que este ataque funciona contra esas herramientas. Tome en cuenta que un error no relacionado significa que las versiones afectadas de OpenSSL no pueden analizar ni construir codificaciones correctas de EDIPARTYNAME. Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptar\u00e1 y, por lo tanto, desencadenar\u00e1 este ataque. Todas las versiones de OpenSSL 1.1.1 y 1.0.2 est\u00e1n afectadas por este problema. Otras versiones de OpenSSL no son compatibles y no se han comprobado. Corregido en OpenSSL versiones 1.1.1i (Afectado versiones 1.1.1-1.1.1h). Corregido en OpenSSL versiones 1.0.2x (Afectado versiones 1.0.2-1.0.2w). Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptar\u00e1 y, por lo tanto, desencadenar\u00e1 este ataque. Todas las versiones de OpenSSL 1.1.1 y 1.0.2 est\u00e1n afectadas por este problema. Otras versiones de OpenSSL no son compatibles y no se han comprobado. Corregido en OpenSSL versi\u00f3n 1.1.1i (Afectada versi\u00f3n 1.1.1-1.1.1h). Corregido en OpenSSL versi\u00f3n 1.0.2x (Afectada versi\u00f3n 1.0.2-1.0.2w). Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptar\u00e1 y, por lo tanto, desencadenar\u00e1 este ataque. Todas las versiones de OpenSSL 1.1.1 y 1.0.2 est\u00e1n afectadas por este problema. Otras versiones de OpenSSL no son compatibles y no se han comprobado. Corregido en OpenSSL versi\u00f3n 1.1.1i (Afectada versi\u00f3n 1.1.1-1.1.1h). Corregido en OpenSSL versi\u00f3n 1.0.2x (Afectada versi\u00f3n 1.0.2-1.0.2w)"}], "id": "CVE-2020-1971", "lastModified": "2024-06-21T19:15:16.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-12-08T16:15:11.730", "references": [{"source": "openssl-security@openssl.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2021/09/14/2"}, {"source": "openssl-security@openssl.org", "tags": ["Third Party Advisory"], "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"}, {"source": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2154ab83e14ede338d2ede9bbe5cdfce5d5a6c9e"}, {"source": "openssl-security@openssl.org", "url": "https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=f960d81215ebf3f65e03d4d5d857fb9b666d6920"}, {"source": "openssl-security@openssl.org", "tags": ["Third Party Advisory"], "url": "https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44676"}, {"source": "openssl-security@openssl.org", "url": "https://lists.apache.org/thread.html/r63c6f2dd363d9b514d0a4bcf624580616a679898cc14c109a49b750c%40%3Cdev.tomcat.apache.org%3E"}, {"source": "openssl-security@openssl.org", "url": "https://lists.apache.org/thread.html/rbb769f771711fb274e0a4acb1b5911c8aab544a6ac5e8c12d40c5143%40%3Ccommits.pulsar.apache.org%3E"}, {"source": "openssl-security@openssl.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00020.html"}, {"source": "openssl-security@openssl.org", "tags": ["Mailing List", "Third Party Advisory"], "url": "https://lists.debian.org/debian-lts-announce/2020/12/msg00021.html"}, {"source": "openssl-security@openssl.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGSI34Y5LQ5RYXN4M2I5ZQT65LFVDOUU/"}, {"source": "openssl-security@openssl.org", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PWPSSZNZOBJU2YR6Z4TGHXKYW3YP5QG7/"}, {"source": "openssl-security@openssl.org", "tags": ["Third Party Advisory"], "url": "https://security.FreeBSD.org/advisories/FreeBSD-SA-20:33.openssl.asc"}, {"source": "openssl-security@openssl.org", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202012-13"}, {"source": "openssl-security@openssl.org", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20201218-0005/"}, {"source": "openssl-security@openssl.org", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"}, {"source": "openssl-security@openssl.org", "url": "https://security.netapp.com/advisory/ntap-20240621-0006/"}, {"source": "openssl-security@openssl.org", "tags": ["Third Party Advisory"], "url": "https://www.debian.org/security/2020/dsa-4807"}, {"source": "openssl-security@openssl.org", "tags": ["Vendor Advisory"], "url": "https://www.openssl.org/news/secadv/20201208.txt"}, {"source": "openssl-security@openssl.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://www.oracle.com//security-alerts/cpujul2021.html"}, {"source": "openssl-security@openssl.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"}, {"source": "openssl-security@openssl.org", "tags": ["Patch", "Third Party Advisory"], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"}, {"source": "openssl-security@openssl.org", "tags": ["Third Party Advisory"], "url": "https://www.oracle.com/security-alerts/cpujan2021.html"}, {"source": "openssl-security@openssl.org", "tags": ["Third Party Advisory"], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"}, {"source": "openssl-security@openssl.org", "tags": ["Third Party Advisory"], "url": "https://www.tenable.com/security/tns-2020-11"}, {"source": "openssl-security@openssl.org", "tags": ["Third Party Advisory"], "url": "https://www.tenable.com/security/tns-2021-09"}, {"source": "openssl-security@openssl.org", "tags": ["Third Party Advisory"], "url": "https://www.tenable.com/security/tns-2021-10"}], "sourceIdentifier": "openssl-security@openssl.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-476"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "Red Hat would like to thank the OpenSSL project for reporting this issue. Upstream acknowledges David Benjamin (Google) as the original reporter.", "affected_release": [{"advisory": "RHSA-2021:0488", "cpe": "cpe:/a:redhat:jboss_core_services:1", "impact": "low", "package": "openssl", "product_name": "JBCS 2.4.37 SP6", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0486", "cpe": "cpe:/a:redhat:jboss_core_services:1::el7", "impact": "low", "package": "jbcs-httpd24-brotli-0:1.0.6-40.jbcs.el7", "product_name": "JBoss Core Services on RHEL 7", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0486", "cpe": "cpe:/a:redhat:jboss_core_services:1::el7", "impact": "low", "package": "jbcs-httpd24-httpd-0:2.4.37-66.jbcs.el7", "product_name": "JBoss Core Services on RHEL 7", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0486", "cpe": "cpe:/a:redhat:jboss_core_services:1::el7", "impact": "low", "package": "jbcs-httpd24-mod_cluster-native-0:1.3.14-16.Final_redhat_2.jbcs.el7", "product_name": "JBoss Core Services on RHEL 7", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0486", "cpe": "cpe:/a:redhat:jboss_core_services:1::el7", "impact": "low", "package": "jbcs-httpd24-mod_http2-0:1.15.7-12.jbcs.el7", "product_name": "JBoss Core Services on RHEL 7", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0486", "cpe": "cpe:/a:redhat:jboss_core_services:1::el7", "impact": "low", "package": "jbcs-httpd24-mod_jk-0:1.2.48-11.redhat_1.jbcs.el7", "product_name": "JBoss Core Services on RHEL 7", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0486", "cpe": "cpe:/a:redhat:jboss_core_services:1::el7", "impact": "low", "package": "jbcs-httpd24-mod_md-1:2.0.8-31.jbcs.el7", "product_name": "JBoss Core Services on RHEL 7", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0486", "cpe": "cpe:/a:redhat:jboss_core_services:1::el7", "impact": "low", "package": "jbcs-httpd24-mod_security-0:2.9.2-58.GA.jbcs.el7", "product_name": "JBoss Core Services on RHEL 7", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0486", "cpe": "cpe:/a:redhat:jboss_core_services:1::el7", "impact": "low", "package": "jbcs-httpd24-nghttp2-0:1.39.2-35.jbcs.el7", "product_name": "JBoss Core Services on RHEL 7", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0486", "cpe": "cpe:/a:redhat:jboss_core_services:1::el7", "impact": "low", "package": "jbcs-httpd24-openssl-1:1.1.1g-3.jbcs.el7", "product_name": "JBoss Core Services on RHEL 7", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0486", "cpe": "cpe:/a:redhat:jboss_core_services:1::el7", "impact": "low", "package": "jbcs-httpd24-openssl-chil-0:1.0.0-3.jbcs.el7", "product_name": "JBoss Core Services on RHEL 7", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0486", "cpe": "cpe:/a:redhat:jboss_core_services:1::el7", "impact": "low", "package": "jbcs-httpd24-openssl-pkcs11-0:0.4.10-18.jbcs.el7", "product_name": "JBoss Core Services on RHEL 7", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0056", "cpe": "cpe:/o:redhat:rhel_els:6", "package": "openssl-0:1.0.1e-59.el6_10", "product_name": "Red Hat Enterprise Linux 6 Extended Lifecycle Support", "release_date": "2021-01-11T00:00:00Z"}, {"advisory": "RHSA-2020:5566", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "openssl-1:1.0.2k-21.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2020-12-16T00:00:00Z"}, {"advisory": "RHSA-2020:5639", "cpe": "cpe:/o:redhat:rhel_aus:7.2", "package": "openssl-1:1.0.1e-52.el7_2", "product_name": "Red Hat Enterprise Linux 7.2 Advanced Update Support", "release_date": "2020-12-21T00:00:00Z"}, {"advisory": "RHSA-2020:5640", "cpe": "cpe:/o:redhat:rhel_aus:7.3", "package": "openssl-1:1.0.1e-61.el7_3", "product_name": "Red Hat Enterprise Linux 7.3 Advanced Update Support", "release_date": "2020-12-21T00:00:00Z"}, {"advisory": "RHSA-2020:5641", "cpe": "cpe:/o:redhat:rhel_aus:7.4", "package": "openssl-1:1.0.2k-9.el7_4", "product_name": "Red Hat Enterprise Linux 7.4 Advanced Update Support", "release_date": "2020-12-21T00:00:00Z"}, {"advisory": "RHSA-2020:5641", "cpe": "cpe:/o:redhat:rhel_tus:7.4", "package": "openssl-1:1.0.2k-9.el7_4", "product_name": "Red Hat Enterprise Linux 7.4 Telco Extended Update Support", "release_date": "2020-12-21T00:00:00Z"}, {"advisory": "RHSA-2020:5641", "cpe": "cpe:/o:redhat:rhel_e4s:7.4", "package": "openssl-1:1.0.2k-9.el7_4", "product_name": "Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions", "release_date": "2020-12-21T00:00:00Z"}, {"advisory": "RHSA-2020:5642", "cpe": "cpe:/o:redhat:rhel_eus:7.6", "package": "openssl-1:1.0.2k-17.el7_6", "product_name": "Red Hat Enterprise Linux 7.6 Extended Update Support", "release_date": "2020-12-21T00:00:00Z"}, {"advisory": "RHSA-2020:5623", "cpe": "cpe:/o:redhat:rhel_eus:7.7", "package": "openssl-1:1.0.2k-20.el7_7", "product_name": "Red Hat Enterprise Linux 7.7 Extended Update Support", "release_date": "2020-12-17T00:00:00Z"}, {"advisory": "RHSA-2020:5476", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "openssl-1:1.1.1g-12.el8_3", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2020-12-15T00:00:00Z"}, {"advisory": "RHSA-2020:5588", "cpe": "cpe:/o:redhat:rhel_e4s:8.0", "package": "openssl-1:1.1.1-9.el8_0", "product_name": "Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions", "release_date": "2020-12-16T00:00:00Z"}, {"advisory": "RHSA-2020:5637", "cpe": "cpe:/o:redhat:rhel_eus:8.1", "package": "openssl-1:1.1.1c-3.el8_1", "product_name": "Red Hat Enterprise Linux 8.1 Extended Update Support", "release_date": "2020-12-21T00:00:00Z"}, {"advisory": "RHSA-2020:5422", "cpe": "cpe:/o:redhat:rhel_eus:8.2", "package": "openssl-1:1.1.1c-16.el8_2", "product_name": "Red Hat Enterprise Linux 8.2 Extended Update Support", "release_date": "2020-12-15T00:00:00Z"}, {"advisory": "RHSA-2021:0491", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1", "impact": "low", "package": "openssl", "product_name": "Red Hat JBoss Web Server 3.1", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0489", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:3.1::el7", "impact": "low", "package": "tomcat-native-0:1.2.23-23.redhat_23.ep7.el7", "product_name": "Red Hat JBoss Web Server 3 for RHEL 7", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0495", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.4", "impact": "low", "package": "openssl", "product_name": "Red Hat JBoss Web Server 5", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0494", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.4::el7", "impact": "low", "package": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el7jws", "product_name": "Red Hat JBoss Web Server 5.4 on RHEL 7", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0494", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.4::el7", "impact": "low", "package": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el7jws", "product_name": "Red Hat JBoss Web Server 5.4 on RHEL 7", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0494", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.4::el8", "impact": "low", "package": "jws5-tomcat-0:9.0.36-9.redhat_8.1.el8jws", "product_name": "Red Hat JBoss Web Server 5.4 on RHEL 8", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0494", "cpe": "cpe:/a:redhat:jboss_enterprise_web_server:5.4::el8", "impact": "low", "package": "jws5-tomcat-native-0:1.2.25-3.redhat_3.el8jws", "product_name": "Red Hat JBoss Web Server 5.4 on RHEL 8", "release_date": "2021-02-11T00:00:00Z"}, {"advisory": "RHSA-2021:0949", "cpe": "cpe:/a:redhat:openshift_do:1.0::el7", "package": "openshiftdo/odo-init-image-rhel7:1.1.3-2", "product_name": "Red Hat OpenShift Do", "release_date": "2021-03-22T00:00:00Z"}], "bugzilla": {"description": "openssl: EDIPARTYNAME NULL pointer de-reference", "id": "1903409", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1903409"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "cwe": "CWE-476", "details": ["The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the \"-crl_download\" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).", "A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability."], "mitigation": {"lang": "en:us", "value": "Applications not using the GENERAL_NAME_cmp of openssl are not vulnerable to this flaw. Even when this function is used, if the attacker can control both the arguments of this function, only then the attacker could trigger a crash."}, "name": "CVE-2020-1971", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Out of support scope", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Not affected", "package_name": "openssl097a", "product_name": "Red Hat Enterprise Linux 5"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "openssl098e", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "openssl098e", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Will not fix", "package_name": "compat-openssl10", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "openssl", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2020-12-08T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2020-1971\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-1971\nhttps://www.openssl.org/news/secadv/20201208.txt"], "statement": "This is a flaw in the GENERAL_NAME_cmp function of openssl which can be triggered when both its arguments are of the same type i.e. EDIPARTYNAME. \n1. Red Hat does not ship any applications compiled with openssl, which used the above function in a vulnerable way.\n2. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes, when comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate and when verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token). If an attacker can control both items being compared then that attacker could trigger a crash. For example, if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then a crash may be triggered.\nThird party applications compiled with openssl using the function GENERAL_NAME_cmp in a vulnerable way are affected by this flaw.\nGENERAL_NAME_cmp was added in 0.9.8k, therefore older versions of openssl are not affected by this flaw.", "threat_severity": "Important", "upstream_fix": "openssl 1.1.1i"}