NULL pointer dereference in OpenSSL - CVE-2020-1967

Vulnerability identifier: #VU27061

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-1967

CWE-ID: CWE-476

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within the SSL_check_chain() function during or after a TLS 1.3 handshake. A remote attacker can send an invalid or unrecognised signature algorithm and perform a denial of service (DoS) attack.

OpenSSL
Gentoo Linux
Arch Linux
Opensuse
openEuler
Fedora
Tenable.sc
openssl (Debian package)
openssl (Alpine package)
openssl-libs
openssl-help
openssl-devel
openssl-debugsource
openssl-debuginfo
openssl
Huawei FusionCube
Enterprise Manager for Storage Management
MySQL Enterprise Monitor
MySQL Server
Nessus Network Monitor
JD Edwards EnterpriseOne Tools
MySQL Connectors
MySQL Workbench
Huawei eLog
Huawei Myna
Oracle HTTP Server
IBM Safer Payments

Install updates from vendor's website.

OpenSSL - update to 1.1.1g
Tenable.sc - update to 5.17.0
openssl (Debian package) - update to 1.1.1d-0+deb10u3
openssl (Alpine package) - update to 1.1.1g-r0
Huawei FusionCube - addressed in versions 3.2.1.SPC300, 6.0.1, 6.0.2
MySQL Enterprise Monitor - update to 8.0.21
Nessus Network Monitor - update to 5.11.1
MySQL Server - update to 5.7.31
Huawei eLog - addressed in versions 9.0.1.11(H100SP9C00), V200R007C10SPC200
Huawei Myna - update to 9.0.1.11(H100SP9C00)
JD Edwards EnterpriseOne Tools - update to 9.2.5.0
openssl-libs - update to 1.1.1f-1
openssl-help - update to 1.1.1f-1
openssl-devel - update to 1.1.1f-1
openssl-debugsource - update to 1.1.1f-1
openssl-debuginfo - update to 1.1.1f-1
openssl - update to 1.1.1f-1
openssl - addressed in versions 1.1.1g-1.fc30, 1.1.1g-1.fc31, 1.1.1g-1.fc32
IBM Safer Payments - addressed in versions 6.1.0.05, 6.2.1.01

• Exploit #2616 - CVE-2020-1967 (Proof of concept exploit about OpenSSL signature_algorithms_cert DoS flaw (CVE-2020-1967)) (April 29, 2020)

• https://www.openssl.org/news/secadv/20200421.txt

• Denial of service in OpenSSL
• Arch Linux update for openssl
• Debian update for openssl
• Gentoo update for OpenSSL
• Nessus Network Monitor update for OpenSSL
• OpenSUSE Linux update for rust, rust-cbindgen
• OpenSUSE Linux update for rust, rust-cbindgen
• Multiple vulnerabilities in MySQL Server
• NULL pointer dereference in MySQL Connectors
• Multiple vulnerabilities in MySQL Enterprise Monitor
• Denial of service in several Huawei products
• NULL pointer dereference in openssl (Alpine package)
• Multiple vulnerabilities in MySQL Workbench
• Multiple vulnerabilities in Oracle HTTP Server
• NULL pointer dereference in Enterprise Manager for Storage Management
• Multiple vulnerabilities in Tenable.sc
• Multiple vulnerabilities in JD Edwards EnterpriseOne Tools
• NULL pointer dereference in IBM Safer Payments
• openEuler 20.03 LTS update for openssl-1.1.1f-1
• Fedora 32 update for openssl
• Fedora 30 update for openssl
• Fedora 31 update for openssl