OpenSSL 1.1.1d/1.1.1e/1.1.1f TLS 1.3 Handshake SSL_check_chain Application null pointer dereference

Summaryinfo

A vulnerability, which was classified as problematic, has been found in OpenSSL 1.1.1d/1.1.1e/1.1.1f. This issue affects the function SSL_check_chain of the component TLS 1.3 Handshake Handler. The manipulation as part of Application leads to null pointer dereference. This vulnerability is traded as CVE-2020-1967. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in OpenSSL 1.1.1d/1.1.1e/1.1.1f (Network Encryption Software). It has been rated as problematic. This issue affects the function SSL_check_chain of the component TLS 1.3 Handshake Handler. The manipulation as part of a Application leads to a null pointer dereference vulnerability. Using CWE to declare the problem leads to CWE-476. A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit. Impacted is availability. The summary by CVE is:

Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).

The weakness was shared 04/21/2020 (Website). The advisory is shared at debian.org. The identification of this vulnerability is CVE-2020-1967 since 12/03/2019. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 211827 (Oracle Linux 9 : edk2 (ELSA-2024-12842)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.1.1g eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.openssl.org. The best possible mitigation is suggested to be patching the affected component.

The vulnerability is also documented in the vulnerability database at Tenable (211827). The entries VDB-158359, VDB-158360, VDB-158362 and VDB-158397 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Network Encryption Software

Name

• OpenSSL

Version

• 1.1.1d
• 1.1.1e
• 1.1.1f

License

• open-source

Website

• Product: https://www.openssl.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion