Critical Denial of Service Vulnerability in OpenSSL Package
Summary
ALPINE-CVE-2020-1967: Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert"... Affects openssl versions < 1.1.1g-r0. Fixed in 1.1.1g-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenSSL is a widely-used open-source software library that provides robust cryptographic functions and secure communication protocols. It is essential for implementing SSL and TLS protocols, enabling secure data transmission over networks. However, certain versions of OpenSSL are vulnerable to a Denial of Service (DoS) attack due to improper handling of the 'signature_algorithms_cert' TLS extension during a TLS 1.3 handshake.
Vulnerability Detail
The vulnerability arises from the SSL_check_chain() function, which may crash applications that call it during or after a TLS 1.3 handshake. This crash occurs due to a NULL pointer dereference when an invalid or unrecognized signature algorithm is received from a peer. The affected versions include OpenSSL 1.1.1d, 1.1.1e, and 1.1.1f. Exploiting this vulnerability could allow a malicious peer to launch a Denial of Service attack, disrupting service availability.
How To Fix
Minimum fixed version
1.1.1g-r0
This is the first release that contains the fix.
sudo apk add --upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not possible, consider disabling TLS 1.3 support in your application as a temporary workaround until the update can be applied. This can often be done by modifying the configuration settings of your application to use an earlier version of TLS.
Conclusion
The OpenSSL vulnerability identified as CVE-2020-1967 poses a significant risk to applications using affected versions. It is crucial to update to the patched version to ensure the security and availability of your services. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for openssl →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
OpenSSL versions 1.1.1d, 1.1.1e, and 1.1.1f are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By using the Vulert playground, you can check if your application is affected without needing to sign up.
The vulnerability can lead to a Denial of Service attack, causing applications to crash and become unavailable to users.
Yes, temporarily disabling TLS 1.3 support in your application can mitigate the risk until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
