Description
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenSSL | OpenSSL | Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f) | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openssl | 1.1.1g-1 | — |
| Debian 13 | openssl | 1.1.1g-1 | — |
| Debian 12 | openssl | 1.1.1g-1 | — |
| Debian 10 | openssl | 1.1.1d-0+deb10u3 | DSA-4661-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | openssl | 1.1.1f-1ubuntu2 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | rust | 1.43.1-12.1 | SUSE-SU-2020:2041-1 |
| SLES 15 SP1 | rust | 1.43.1-12.1 | SUSE-SU-2020:2041-1 |
| SLES 12 SP5 | openssl-1_1 | 1.1.1d-2.23.1 | SUSE-SU-2020:1058-1 |
| SLES 12 SP4 | openssl-1_1 | 1.1.1d-2.23.1 | SUSE-SU-2020:1058-1 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | openssl-1_1 | 1.1.1d-2.23.1 | SUSE-SU-2020:1058-1 |
| SLES for SAP 12 SP4 | openssl-1_1 | 1.1.1d-2.23.1 | SUSE-SU-2020:1058-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | openssl-1_1 | 1.1.1l-1.2 | openSUSE-SU-2024:11127-1 |
| openSUSE Tumbleweed | rust1.53 | 1.53.0-2.5 | openSUSE-SU-2024:11360-1 |
| openSUSE Leap 15.2 | rust | 1.43.1-lp152.3.5.1 | openSUSE-SU-2020:0945-1 |
| openSUSE Leap 15.2 | rust-cbindgen | 0.14.1-lp152.2.4.1 | openSUSE-SU-2020:0945-1 |
| openSUSE Leap 15.1 | rust | 1.43.1-lp151.5.13.1 | openSUSE-SU-2020:0933-1 |
| openSUSE Leap 15.1 | rust-cbindgen | 0.14.1-lp151.8.2 | openSUSE-SU-2020:0933-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | openssl | 1.1.1g-r0 | — |
| Alpine v3.23 | openssl | 1.1.1g-r0 | — |
| Alpine v3.22 | openssl | 1.1.1g-r0 | — |
| Alpine v3.21 | openssl | 1.1.1g-r0 | — |
| Alpine v3.20 | openssl | 1.1.1g-r0 | — |
Show 11 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | openssl | 1.1.1g-r0 | — |
| Alpine v3.18 | openssl +1 | 1.1.1g-r0 | — |
| Alpine v3.17 | openssl +1 | 1.1.1g-r0 | — |
| Alpine v3.16 | openssl +1 | 1.1.1g-r0 | — |
| Alpine v3.15 | openssl +1 | 1.1.1g-r0 | — |
| Alpine v3.14 | openssl | 1.1.1g-r0 | — |
| Alpine v3.13 | openssl | 1.1.1g-r0 | — |
| Alpine v3.12 | openssl | 1.1.1g-r0 | — |
| Alpine v3.11 | openssl | 1.1.1g-r0 | — |
| Alpine v3.10 | openssl | 1.1.1g-r0 | — |
| Alpine v3.9 | openssl | 1.1.1g-r0 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
irsl/CVE-2020-1967 ★ 20 · Apr 28, 2020
Proof of concept exploit about OpenSSL signature_algorithms_cert DoS flaw (CVE-2020-1967)
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | openssl-src | >= 111.6.0, < 111.9.0 | 111.9.0 | GHSA-jq65-29v4-4x35 |
Advisories 12
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- DSA-4661-1 openssl - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2020:2041-1 Security update for rust, rust-cbindgen SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11360-1 cargo1.53-1.53.0-2.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:0945-1 Security update for rust, rust-cbindgen SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2020:1058-1 Security update for openssl-1_1 SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2026-0205 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 25, 2026
- openSUSE-SU-2020:0933-1 Security update for rust, rust-cbindgen SUSE / openSUSE Security Updates · May 7, 2025
- openSUSE-SU-2024:11127-1 libopenssl-1_1-devel-1.1.1l-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2023-3080 OpenSSL: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 25, 2024
- ICSA-24-046-02 Siemens SIDIS Prime CISA ICS & IT advisories · Feb 13, 2024
- SSA-108696 SSA-108696: Multiple Vulnerabilities in SIDIS Prime before V4.0.400 Siemens ProductCERT · Feb 13, 2024
References
- FreeBSD-SA-20:11 vendor-advisory
- DSA-4661 vendor-advisory
- [oss-security] 20200422 [CVE-2020-1967] OpenSSL 1.1.1d+ Segmentation fault in SSL_check_chain mailing-list
- [tomcat-dev] 20200422 Time for Tomcat Native 1.2.24? mailing-list
- [tomcat-dev] 20200422 Re: Time for Tomcat Native 1.2.24? mailing-list
- [tomcat-dev] 20200423 Re: Time for Tomcat Native 1.2.24? mailing-list
- GLSA-202004-10 vendor-advisory
- FEDORA-2020-fcc91a28e8 vendor-advisory
- FEDORA-2020-da2d1ef2d7 vendor-advisory
- 20200501 CVE-2020-1967: proving sigalg != NULL mailing-list
- FEDORA-2020-d7b29838f6 vendor-advisory
- openSUSE-SU-2020:0933 vendor-advisory
- openSUSE-SU-2020:0945 vendor-advisory
- https://www.oracle.com/security-alerts/cpujul2020.html
- https://www.tenable.com/security/tns-2020-03
- https://www.openssl.org/news/secadv/20200421.txt
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=eb563247aef3e83dda7679c43f9649270462e5b1
- https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440
- https://security.netapp.com/advisory/ntap-20200424-0003/
- https://www.synology.com/security/advisory/Synology_SA_20_05_OpenSSL
- https://github.com/irsl/CVE-2020-1967
- http://packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.html
- https://www.synology.com/security/advisory/Synology_SA_20_05
- https://www.tenable.com/security/tns-2020-04
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20200717-0004/
- https://www.oracle.com/security-alerts/cpujan2021.html
- https://www.tenable.com/security/tns-2020-11
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.tenable.com/security/tns-2021-10
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html