Segmentation fault in SSL_check_chain
Priority HIGH 71CWE-476Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Microsoft. Impact type from CWE-476.
Summary
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.53336 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed openssl-src (crates.io): 111.9.0Microsoft: 1 update
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenSSL | OpenSSL | Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f) | — | No fix listed | CNA |
| — | openssl-src (crates.io) | 111.6.0 to before 111.9.0 | 111.9.0 | Patch available | GHSA-jq65-29v4-4x35 |
- OpenSSL VendorOpenSSL Affected Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f) Fixed in — No fix listed CNA
- openssl-src (crates.io) Vendor— Affected 111.6.0 to before 111.9.0 Fixed in 111.9.0 Patch available GHSA-jq65-29v4-4x35
CPE configurations NVD · 35
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* | 1.1.1d – 1.1.1f | Vulnerable | OpenSSL |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:freebsd:freebsd:12.1:-:*:*:*:*:*:* | 12.1 | Vulnerable | FreeBSD |
| cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* | 30 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* | 31 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:a:oracle:application_server:12.1.3:*:*:*:*:*:*:* | 12.1.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* | 13.4.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.3.0.0:*:*:*:*:*:*:* | 13.3.0.0 | Vulnerable | Oracle |
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions 1.1.1d – 1.1.1f Vulnerable ·OpenSSL
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:freebsd:freebsd:12.1:-:*:*:*:*:*:* Versions 12.1 Vulnerable ·FreeBSD
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:a:oracle:application_server:12.1.3:*:*:*:*:*:*:* Versions 12.1.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:* Versions 13.4.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.3.0.0:*:*:*:*:*:*:* Versions 13.3.0.0 Vulnerable ·Oracle
Show 25 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:* | 13.4.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* | 12.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* | 12.2.1.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:* | a9.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* | up to 5.6.48; 5.7.0 – 5.7.30; 8.0.0 – 8.0.20 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:* | up to 8.0.20 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* | up to 4.0.12; 8.0.0 – 8.0.20 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* | up to 8.0.21 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* | 8.56 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* | 8.57 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* | 8.58 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* | 8.59 | Vulnerable | Oracle |
| cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* | 7.3 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* | 9.5 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Broadcom |
| cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* | 15.1 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* | 15.2 | Vulnerable | openSUSE |
| cpe:2.3:a:jdedwards:enterpriseone:*:*:*:*:*:*:*:* | before 9.2.5.0 | Vulnerable | Jdedwards |
| cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:* | before 6.0.9 | Vulnerable | Tenable |
- cpe:2.3:a:oracle:enterprise_manager_for_storage_management:13.4.0.0:*:*:*:*:*:*:* Versions 13.4.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:http_server:12.2.1.4.0:*:*:*:*:*:*:* Versions 12.2.1.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:jd_edwards_world_security:a9.4:*:*:*:*:*:*:* Versions a9.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql:*:*:*:*:*:*:*:* Versions up to 5.6.48; 5.7.0 – 5.7.30; 8.0.0 – 8.0.20 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_connectors:*:*:*:*:*:*:*:* Versions up to 8.0.20 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_enterprise_monitor:*:*:*:*:*:*:*:* Versions up to 4.0.12; 8.0.0 – 8.0.20 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* Versions up to 8.0.21 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:* Versions 8.56 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:* Versions 8.57 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:* Versions 8.58 Vulnerable ·Oracle
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:* Versions 8.59 Vulnerable ·Oracle
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:windows:*:* Versions 7.3 Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* Versions 9.5 Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_performance_analyzer:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Broadcom
- cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* Versions 15.1 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:* Versions 15.2 Vulnerable ·openSUSE
- cpe:2.3:a:jdedwards:enterpriseone:*:*:*:*:*:*:*:* Versions before 9.2.5.0 Vulnerable ·Jdedwards
- cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:* Versions before 6.0.9 Vulnerable ·Tenable
Remediation
- Fix · GHSA-jq65-29v4-4x35 openssl-src (crates.io) Fixed in 111.9.0 Advisory →
Microsoft 1 update
- OpenSSL Remote Denial of Service Vulnerability
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 9 products
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat JBoss Core Services
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Enterprise Web Server 2
- Red Hat JBoss Web Server 3
- Red Hat JBoss Web Server 5
Timeline
- 2026-10-02 Threatist record created from CVE-2020-1967
- 2026-10-03 Alias added: GHSA-jq65-29v4-4x35
- 2026-10-08 CISA SSVC decision points changed
References
Patch 6
Advisory 22
- DSA-4661
- [oss-security] 20200422 [CVE-2020-1967] OpenSSL 1.1.1d+ Segmentation fault in SSL_check_chain
- GLSA-202004-10
- FEDORA-2020-fcc91a28e8
- FEDORA-2020-da2d1ef2d7
- 20200501 CVE-2020-1967: proving sigalg != NULL
- FEDORA-2020-d7b29838f6
- openSUSE-SU-2020:0933
- openSUSE-SU-2020:0945
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.tenable.com/security/tns-2020-03
- https://www.openssl.org/news/secadv/20200421.txt
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440
- https://security.netapp.com/advisory/ntap-20200424-0003/
- https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL
- http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html
- https://www.synology.com/security/advisory/Synology_SA_20_05
- https://www.tenable.com/security/tns-2020-04
- https://security.netapp.com/advisory/ntap-20200717-0004/
- https://www.tenable.com/security/tns-2020-11
- https://www.tenable.com/security/tns-2021-10
- https://nvd.nist.gov/vuln/detail/CVE-2020-1967
Other 14
- [tomcat-dev] 20200422 Time for Tomcat Native 1.2.24?
- [tomcat-dev] 20200422 Re: Time for Tomcat Native 1.2.24?
- [tomcat-dev] 20200423 Re: Time for Tomcat Native 1.2.24?
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1
- https://security.netapp.com/advisory/ntap-20200717-0004
- https://security.netapp.com/advisory/ntap-20200424-0003
- https://rustsec.org/advisories/RUSTSEC-2020-0015.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XVEP3LAK4JSPRXFO4QF4GG2IVXADV3SO
- https://lists.fedoraproject.org/archives/list/[email protected]/message/EXDDAOWSAIEFQNBHWYE6PPYFV4QXGMCD
- https://lists.fedoraproject.org/archives/list/[email protected]/message/DDHOAATPWJCXRNFMJ2SASDBBNU5RJONY
- https://lists.apache.org/thread.html/r9a41e304992ce6aec6585a87842b4f2e692604f5c892c37e3b0587ee@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r94d6ac3f010a38fccf4f432b12180a13fa1cf303559bd805648c9064@%3Cdev.tomcat.apache.org%3E
- https://lists.apache.org/thread.html/r66ea9c436da150683432db5fbc8beb8ae01886c6459ac30c2cea7345@%3Cdev.tomcat.apache.org%3E
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=eb563247aef3e83dda7679c43f9649270462e5b1
More Openssl vulnerabilities
- TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
- TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
- TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
- TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
- TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8
Sources
- CVE-2020-1967 · CVE Program
- CVE-2020-1967 · NVD
- FIRST EPSS
- GHSA-jq65-29v4-4x35 · GitHub Advisory Database · CC BY 4.0
- CVE-2020-1967 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences