Attacker Value
Unknown
CVE-2020-1967
CVE-2020-1967
(Last updated November 08, 2023) ▾
MITRE ATT&CK
Log in to add MITRE ATT&CK tag
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Description
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the “signature_algorithms_cert” TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
Data provided by the National Vulnerability Database (NVD)
Base Score:
7.5 High
Impact Score:
3.6
Exploitability Score:
3.9
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
None
Integrity (I):
None
Availability (A):
High
General Information
Vendors
- broadcom,
- debian,
- fedoraproject,
- freebsd,
- jdedwards,
- netapp,
- openssl,
- opensuse,
- oracle,
- tenable
Products
- active iq unified manager,
- application server 12.1.3,
- debian linux 10.0,
- debian linux 9.0,
- e-series performance analyzer -,
- enterprise manager base platform 13.4.0.0,
- enterprise manager for storage management 13.3.0.0,
- enterprise manager for storage management 13.4.0.0,
- enterprise manager ops center 12.4.0,
- enterpriseone,
- fabric operating system -,
- fedora 30,
- fedora 31,
- fedora 32,
- freebsd 12.1,
- http server 12.2.1.4.0,
- jd edwards world security a9.4,
- leap 15.1,
- leap 15.2,
- log correlation engine,
- mysql,
- mysql connectors,
- mysql enterprise monitor,
- mysql workbench,
- oncommand insight -,
- oncommand workflow automation -,
- openssl,
- peoplesoft enterprise peopletools 8.56,
- peoplesoft enterprise peopletools 8.57,
- peoplesoft enterprise peopletools 8.58,
- peoplesoft enterprise peopletools 8.59,
- smi-s provider -,
- snapcenter -,
- steelstore cloud integrated storage -
