CVE-2020-1967
🟡 Monitoruj
Błąd w OpenSSL powoduje awarię aplikacji przy nieprawidłowym algorytmie podpisu.
CVSS
7.5
EPSS
53.3%
Exploit
poc
Vendor
oracle
Opis źródłowy (NVD)
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
dos exploit
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.5 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 53.3% |
| Opublikowano (NVD) | 2020-04-21 14:15:11 UTC |
| Ostatnia modyfikacja (NVD) | 2026-10-08 21:17:24 UTC |
Referencje
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.html ([email protected]) [Mailing List, Third Party Advisory]
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.html ([email protected]) [Mailing List, Third Party Advisory]
- http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html ([email protected]) [Third Party Advisory, VDB Entry]
- http://seclists.org/fulldisclosure/2020/May/5 ([email protected]) [Mailing List, Third Party Advisory]
- http://www.openwall.com/lists/oss-security/2020/04/22/2 ([email protected]) [Mailing List, Third Party Advisory]
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1 ([email protected])
- https://github.com/irsl/CVE-2020-1967 ([email protected]) [Exploit, Third Party Advisory]
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440 ([email protected]) [Third Party Advisory]
- https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345%40%3Cdev.tomcat.apache.org%3E ([email protected])
- https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064%40%3Cdev.tomcat.apache.org%3E ([email protected])
- https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee%40%3Cdev.tomcat.apache.org%3E ([email protected])
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY/ ([email protected])
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD/ ([email protected])
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO/ ([email protected])
- https://security.FreeBSD.org/advisories/FreeBSD-SA-20:11.openssl.asc ([email protected]) [Patch, Third Party Advisory]
- https://security.gentoo.org/glsa/202004-10 ([email protected]) [Third Party Advisory]
- https://security.netapp.com/advisory/ntap-20200424-0003/ ([email protected]) [Third Party Advisory]
- https://security.netapp.com/advisory/ntap-20200717-0004/ ([email protected]) [Third Party Advisory]
- https://www.debian.org/security/2020/dsa-4661 ([email protected]) [Third Party Advisory]
- https://www.openssl.org/news/secadv/20200421.txt ([email protected]) [Vendor Advisory]
- https://www.oracle.com//security-alerts/cpujul2021.html ([email protected]) [Patch, Third Party Advisory]
- https://www.oracle.com/security-alerts/cpuApr2021.html ([email protected]) [Patch, Third Party Advisory]
- https://www.oracle.com/security-alerts/cpujan2021.html ([email protected]) [Patch, Third Party Advisory]
- https://www.oracle.com/security-alerts/cpujul2020.html ([email protected]) [Third Party Advisory]
- https://www.oracle.com/security-alerts/cpuoct2020.html ([email protected]) [Patch, Third Party Advisory]
- https://www.oracle.com/security-alerts/cpuoct2021.html ([email protected]) [Patch, Third Party Advisory]
- https://www.synology.com/security/advisory/Synology_SA_20_05 ([email protected]) [Third Party Advisory]
- https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL ([email protected]) [Third Party Advisory]
- https://www.tenable.com/security/tns-2020-03 ([email protected]) [Third Party Advisory]
- https://www.tenable.com/security/tns-2020-04 ([email protected]) [Third Party Advisory]
- https://www.tenable.com/security/tns-2020-11 ([email protected]) [Third Party Advisory]
- https://www.tenable.com/security/tns-2021-10 ([email protected]) [Third Party Advisory]