CVE-2020-1967

A NULL pointer dereference flaw was found in the way OpenSSL handled certain TLS handshake messages. This flaw allows an unauthenticated attacker to cause a server application compiled with OpenSSL to crash, causing a denial of service. In some cases a malicious server could also cause a client compiled with OpenSSL to crash.

This flaw was introduced by the following OpenSSL commit: https://github.com/openssl/openssl/commit/5235ef44b93306a14d0b6c695b13c64b16e1fdec which was shipped as a part of OpenSSL-1.1.1d, therefore older versions are not affected by this flaw. OpenSSL packages shipped with Red Hat Products are NOT affected by this flaw.

The affected signature_algorithm_cert check which causes the flaw is only applied to TLS 1.3, therefore older versions of TLS are not be affected by this flaw.

Also, the vulnerable SSL_check_chain() is not called directly from libssl, but may be used by the application inside a callback (e.g., client_hello or cert callback) to verify that a candidate certificate chain will be acceptable to the client. Thus, applications that use openssl without invoking the SSL_check_chain() function are not vulnerable to this flaw.

Lastly, no Red Hat Middleware products ship the affected version of OpenSSL. However, some components, such as Netty and Wildfly, may be configured by customers to use any OpenSSL version. Customers who have configured their setups to use a vulnerable version of OpenSSL are advised to upgrade to the latest unaffected version immediately.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.