CVE-2020-1967 OpenSSL
| Affected software | OpenSSL |
|---|---|
| Severity | 7.5 High CVSS 3.1 2 scores |
| Weakness | CWE-476 |
| Published | 21 Apr 2020 |
| Updated | 8 Oct 2026 |
Description
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
Exploitation status
Proof of concept only
A proof of concept exists, but no reviewed exploit catalogue lists this CVE.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment exploitation: none
- Indexed PoC 1 indexed Published artifacts you can open, in GitHub PoC; first seen 2020-04-28.
- EPSS 53% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99% of all scored CVEs.
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | Proof of concept exploit about OpenSSL signature_algorithms_cert DoS flaw (CVE-2020-1967) | 20 | 2020-04-28 |
Waratek protection
A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.
- Protection none
- Action not pursued none
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product. |
CVSS
7.5 HIGH
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
2 metrics
CVSS
7.5 HIGH v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 7.5 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
NVD | Primary | published |
| CVSS 2.0 | 5.0 | none | AV:N/AC:L/Au:N/C:N/I:N/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2021 ↗ | CPU | 2021-Q4 | Oracle PeopleSoft / DPK (OpenSSL) (8.57, 8.58, 8.59) |
| Oracle Critical Patch Update April 2021 ↗ | CPU | 2021-Q2 | Oracle E-Business Suite / Technology Stack (OpenSSL) (12.1.3) |
| Oracle Critical Patch Update January 2021 ↗ | CPU | 2021-Q1 | Oracle JD Edwards / Enterprise Infrastructure SEC (OpenSSL) (Prior to 9.2.5.0) |
| Oracle Critical Patch Update October 2020 ↗ | CPU | 2020-Q4 | Oracle Enterprise Manager / Privilege Management (OpenSSL) (13.3.0.0, 13.4.0.0) Oracle Fusion Middleware / SSL Module (OpenSSL) (12.2.1.4.0) Oracle MySQL / Workbench: Security: Encryption (OpenSSL) (8.0.21 and prior) |
| Oracle Critical Patch Update July 2020 ↗ | CPU | 2020-Q3 | Oracle MySQL / Connector/C++ (OpenSSL) (8.0.20 and prior) Oracle MySQL / Connector/ODBC (OpenSSL) (8.0.20 and prior) Oracle MySQL / Monitoring: General (OpenSSL) (4.0.12 and prior, 8.0.20 and prior) Oracle's note: This CVE is not exploitable in MySQL Enterprise Monitor. The CVSS v3.1 Base Score for this CVE in the National Vulnerability Database (NVD) is 7.5. Oracle MySQL / Server: Security: Encryption (OpenSSL) (5.6.48 and prior, 5.7.30 and prior, 8.0.20 and prior) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle E-Business Suite | Technology Stack (OpenSSL) | 12.1.3 | 12.1.3 |
| Oracle Enterprise Manager | Privilege Management (OpenSSL) | 13.3.0.0, 13.4.0.0 | 13.3.0.0 · 13.4.0.0 |
| Oracle Fusion Middleware | SSL Module (OpenSSL) | 12.2.1.4.0 | 12.2.1.4.0 |
| Oracle JD Edwards | Enterprise Infrastructure SEC (OpenSSL) | Prior to 9.2.5.0 | |
| Oracle MySQL | Connector/C++ (OpenSSL) | 8.0.20 and prior | |
| Oracle MySQL | Connector/ODBC (OpenSSL) | 8.0.20 and prior | |
| Oracle MySQL | Monitoring: General (OpenSSL) | 4.0.12 and prior, 8.0.20 and prior | |
| Oracle MySQL | Server: Security: Encryption (OpenSSL) | 5.6.48 and prior, 5.7.30 and prior, 8.0.20 and prior | |
| Oracle MySQL | Workbench: Security: Encryption (OpenSSL) | 8.0.21 and prior | |
| Oracle PeopleSoft | DPK (OpenSSL) | 8.57, 8.58, 8.59 | 8.57 · 8.58 · 8.59 |
Products and versions
26 products, 38 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | broadcom | fabric operating system | generic | any version |
| nvd | debian | debian linux | generic | 9.0 · 10.0 |
| nvd | fedoraproject | fedora | generic | 30 · 31 · 32 |
| nvd | freebsd | freebsd | generic | 12.1 |
| nvd | jdedwards | enterpriseone | generic | ＜ 9.2.5.0 |
| nvd | netapp | active iq unified manager | generic | ≥ 7.3 · ≥ 9.5 |
| nvd | netapp | e-series performance analyzer | generic | any version |
| nvd | netapp | oncommand insight | generic | any version |
| nvd | netapp | oncommand workflow automation | generic | any version |
| nvd | netapp | smi-s provider | generic | any version |
| nvd | netapp | snapcenter | generic | any version |
| nvd | netapp | steelstore cloud integrated storage | generic | any version |
| nvd | openssl | openssl | generic | ≥ 1.1.1 and ≤ 1.1.1 |
| nvd | opensuse | leap | generic | 15.1 · 15.2 |
| nvd | oracle | application server | generic | 12.1.3 |
| nvd | oracle | enterprise manager base platform | generic | 13.4.0.0 |
| nvd | oracle | enterprise manager for storage management | generic | 13.3.0.0 · 13.4.0.0 |
| nvd | oracle | enterprise manager ops center | generic | 12.4.0 |
| nvd | oracle | http server | generic | 12.2.1.4.0 |
| nvd | oracle | jd edwards world security | generic | a9.4 |
| nvd | oracle | mysql | generic | ≤ 5.6.48 · ≥ 5.7.0 and ≤ 5.7.30 · ≥ 8.0.0 and ≤ 8.0.20 |
| nvd | oracle | mysql connectors | generic | ≤ 8.0.20 |
| nvd | oracle | mysql enterprise monitor | generic | ≤ 4.0.12 · ≥ 8.0.0 and ≤ 8.0.20 |
| nvd | oracle | mysql workbench | generic | ≤ 8.0.21 |
| nvd | oracle | peoplesoft enterprise peopletools | generic | 8.56 · 8.57 · 8.58 · 8.59 |
| nvd | tenable | log correlation engine | generic | ＜ 6.0.9 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** MYSQL PROTOCOL, TECHNOLOGY STACK (OPENSSL), MONITORING: GENERAL (OPENSSL), MYSQL WORKBENCH, NO AUTH REMOTE EXPLOIT, SEE NOTE 2, WORKBENCH: SECURITY: ENCRYPTION (OPENSSL), SERVER: SECURITY: ENCRYPTION (OPENSSL), HTTPS, SSL MODULE (OPENSSL), TLS, JDENET, CONNECTOR/ODBC (OPENSSL), ENTERPRISE INFRASTRUCTURE SEC (OPENSSL), PRIVILEGE MANAGEMENT (OPENSSL), CONNECTOR/C++ (OPENSSL), DPK (OPENSSL) **Products:** ORACLE ENTERPRISE MANAGER, ENTERPRISE MANAGER FOR STORAGE MANAGEMENT, ORACLE E-BUSINESS SUITE, MYSQL WORKBENCH, MYSQL CONNECTORS, ORACLE HTTP SERVER, MYSQL ENTERPRISE MONITOR, ORACLE FUSION MIDDLEWARE, APPLICATION SERVER, ORACLE MYSQL, MYSQL SERVER, ORACLE JD EDWARDS, OPENSSL, JD EDWARDS ENTERPRISEONE TOOLS, ORACLE PEOPLESOFT, PEOPLESOFT ENTERPRISE PEOPLETOOLS
References
Timeline
Timeline
| Published | 2020-04-21 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-10-08 | NVD's own last-modified date for this record. |