// For flags

CVE-2020-1971

EDIPARTYNAME NULL pointer dereference

Severity Score

5.9
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).

El tipo GeneralName X.509 es un tipo genérico para representar diferentes tipos de nombres. Uno de esos tipos de nombres se conoce como EDIPartyName. OpenSSL proporciona una función GENERAL_NAME_cmp que compara diferentes instancias de GENERAL_NAME para ver si son iguales o no. Esta función se comporta incorrectamente cuando ambos GENERAL_NAME contienen un EDIPARTYNAME. Es posible que se produzca una desreferencia del puntero NULL y un bloqueo que conduzca a un posible ataque de denegación de servicio. El propio OpenSSL usa la función GENERAL_NAME_cmp para dos propósitos: 1) Comparación de nombres de puntos de distribución de CRL entre una CRL disponible y un punto de distribución de CRL insertado en un certificado X509 2) Al comparar que un firmante de token de respuesta de marca de tiempo coincide con el nombre de autoridad de marca de tiempo (expuesto por medio de las funciones API TS_RESP_verify_response y TS_RESP_verify_token) Si un atacante puede controlar ambos elementos que se están comparando, entonces ese atacante podría desencadenar un bloqueo. Por ejemplo, si el atacante puede engañar a un cliente o servidor para que compruebe un certificado malicioso con una CRL maliciosa, esto puede ocurrir. Tome en cuenta que algunas aplicaciones descargan automáticamente las CRL basadas en una URL insertada en un certificado. Esta comprobación ocurre antes de que se verifiquen las firmas en el certificado y la CRL. Las herramientas s_server, s_client y verify de OpenSSL tienen soporte para la opción "-crl_download" que implementa la descarga automática de CRL y se ha demostrado que este ataque funciona contra esas herramientas. Tome en cuenta que un error no relacionado significa que las versiones afectadas de OpenSSL no pueden analizar ni construir codificaciones correctas de EDIPARTYNAME. Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptará y, por lo tanto, desencadenará este ataque. Todas las versiones de OpenSSL 1.1.1 y 1.0.2 están afectadas por este problema. Otras versiones de OpenSSL no son compatibles y no se han comprobado. Corregido en OpenSSL versiones 1.1.1i (Afectado versiones 1.1.1-1.1.1h). Corregido en OpenSSL versiones 1.0.2x (Afectado versiones 1.0.2-1.0.2w). Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptará y, por lo tanto, desencadenará este ataque. Todas las versiones de OpenSSL 1.1.1 y 1.0.2 están afectadas por este problema. Otras versiones de OpenSSL no son compatibles y no se han comprobado. Corregido en OpenSSL versión 1.1.1i (Afectada versión 1.1.1-1.1.1h). Corregido en OpenSSL versión 1.0.2x (Afectada versión 1.0.2-1.0.2w). Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptará y, por lo tanto, desencadenará este ataque. Todas las versiones de OpenSSL 1.1.1 y 1.0.2 están afectadas por este problema. Otras versiones de OpenSSL no son compatibles y no se han comprobado. Corregido en OpenSSL versión 1.1.1i (Afectada versión 1.1.1-1.1.1h). Corregido en OpenSSL versión 1.0.2x (Afectada versión 1.0.2-1.0.2w)

A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.

*Credits: David Benjamin (Google)
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-12-03 CVE Reserved
  • 2020-12-08 CVE Published
  • 2020-12-10 First Exploit
  • 2024-09-17 CVE Updated
  • 2024-10-29 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-476: NULL Pointer Dereference
CAPEC
References (29)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Netapp
Search vendor "Netapp"
Ef600a Firmware
Search vendor "Netapp" for product "Ef600a Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
Ef600a
Search vendor "Netapp" for product "Ef600a"
--
Safe
Netapp
Search vendor "Netapp"
Aff A250 Firmware
Search vendor "Netapp" for product "Aff A250 Firmware"
--
Affected
in Netapp
Search vendor "Netapp"
Aff A250
Search vendor "Netapp" for product "Aff A250"
--
Safe
Openssl
Search vendor "Openssl"
Openssl
Search vendor "Openssl" for product "Openssl"
>= 1.0.2 < 1.0.2x
Search vendor "Openssl" for product "Openssl" and version " >= 1.0.2 < 1.0.2x"
-
Affected
Openssl
Search vendor "Openssl"
Openssl
Search vendor "Openssl" for product "Openssl"
>= 1.1.1 < 1.1.1i
Search vendor "Openssl" for product "Openssl" and version " >= 1.1.1 < 1.1.1i"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
9.0
Search vendor "Debian" for product "Debian Linux" and version "9.0"
-
Affected
Debian
Search vendor "Debian"
Debian Linux
Search vendor "Debian" for product "Debian Linux"
10.0
Search vendor "Debian" for product "Debian Linux" and version "10.0"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
32
Search vendor "Fedoraproject" for product "Fedora" and version "32"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
Fedora
Search vendor "Fedoraproject" for product "Fedora"
33
Search vendor "Fedoraproject" for product "Fedora" and version "33"
-
Affected
Oracle
Search vendor "Oracle"
Api Gateway
Search vendor "Oracle" for product "Api Gateway"
11.1.2.4.0
Search vendor "Oracle" for product "Api Gateway" and version "11.1.2.4.0"
-
Affected
Oracle
Search vendor "Oracle"
Business Intelligence
Search vendor "Oracle" for product "Business Intelligence"
5.5.0.0.0
Search vendor "Oracle" for product "Business Intelligence" and version "5.5.0.0.0"
enterprise
Affected
Oracle
Search vendor "Oracle"
Business Intelligence
Search vendor "Oracle" for product "Business Intelligence"
5.9.0.0.0
Search vendor "Oracle" for product "Business Intelligence" and version "5.9.0.0.0"
enterprise
Affected
Oracle
Search vendor "Oracle"
Business Intelligence
Search vendor "Oracle" for product "Business Intelligence"
12.2.1.3.0
Search vendor "Oracle" for product "Business Intelligence" and version "12.2.1.3.0"
enterprise
Affected
Oracle
Search vendor "Oracle"
Business Intelligence
Search vendor "Oracle" for product "Business Intelligence"
12.2.1.4.0
Search vendor "Oracle" for product "Business Intelligence" and version "12.2.1.4.0"
enterprise
Affected
Oracle
Search vendor "Oracle"
Communications Cloud Native Core Network Function Cloud Native Environment
Search vendor "Oracle" for product "Communications Cloud Native Core Network Function Cloud Native Environment"
1.10.0
Search vendor "Oracle" for product "Communications Cloud Native Core Network Function Cloud Native Environment" and version "1.10.0"
-
Affected
Oracle
Search vendor "Oracle"
Communications Diameter Intelligence Hub
Search vendor "Oracle" for product "Communications Diameter Intelligence Hub"
>= 8.0.0 <= 8.1.0
Search vendor "Oracle" for product "Communications Diameter Intelligence Hub" and version " >= 8.0.0 <= 8.1.0"
-
Affected
Oracle
Search vendor "Oracle"
Communications Diameter Intelligence Hub
Search vendor "Oracle" for product "Communications Diameter Intelligence Hub"
>= 8.2.0 <= 8.2.3
Search vendor "Oracle" for product "Communications Diameter Intelligence Hub" and version " >= 8.2.0 <= 8.2.3"
-
Affected
Oracle
Search vendor "Oracle"
Communications Session Border Controller
Search vendor "Oracle" for product "Communications Session Border Controller"
cz8.2
Search vendor "Oracle" for product "Communications Session Border Controller" and version "cz8.2"
-
Affected
Oracle
Search vendor "Oracle"
Communications Session Border Controller
Search vendor "Oracle" for product "Communications Session Border Controller"
cz8.3
Search vendor "Oracle" for product "Communications Session Border Controller" and version "cz8.3"
-
Affected
Oracle
Search vendor "Oracle"
Communications Session Border Controller
Search vendor "Oracle" for product "Communications Session Border Controller"
cz8.4
Search vendor "Oracle" for product "Communications Session Border Controller" and version "cz8.4"
-
Affected
Oracle
Search vendor "Oracle"
Communications Session Router
Search vendor "Oracle" for product "Communications Session Router"
cz8.2
Search vendor "Oracle" for product "Communications Session Router" and version "cz8.2"
-
Affected
Oracle
Search vendor "Oracle"
Communications Session Router
Search vendor "Oracle" for product "Communications Session Router"
cz8.3
Search vendor "Oracle" for product "Communications Session Router" and version "cz8.3"
-
Affected
Oracle
Search vendor "Oracle"
Communications Session Router
Search vendor "Oracle" for product "Communications Session Router"
cz8.4
Search vendor "Oracle" for product "Communications Session Router" and version "cz8.4"
-
Affected
Oracle
Search vendor "Oracle"
Communications Subscriber-aware Load Balancer
Search vendor "Oracle" for product "Communications Subscriber-aware Load Balancer"
cz8.2
Search vendor "Oracle" for product "Communications Subscriber-aware Load Balancer" and version "cz8.2"
-
Affected
Oracle
Search vendor "Oracle"
Communications Subscriber-aware Load Balancer
Search vendor "Oracle" for product "Communications Subscriber-aware Load Balancer"
cz8.3
Search vendor "Oracle" for product "Communications Subscriber-aware Load Balancer" and version "cz8.3"
-
Affected
Oracle
Search vendor "Oracle"
Communications Subscriber-aware Load Balancer
Search vendor "Oracle" for product "Communications Subscriber-aware Load Balancer"
cz8.4
Search vendor "Oracle" for product "Communications Subscriber-aware Load Balancer" and version "cz8.4"
-
Affected
Oracle
Search vendor "Oracle"
Communications Unified Session Manager
Search vendor "Oracle" for product "Communications Unified Session Manager"
scz8.2.5
Search vendor "Oracle" for product "Communications Unified Session Manager" and version "scz8.2.5"
-
Affected
Oracle
Search vendor "Oracle"
Enterprise Communications Broker
Search vendor "Oracle" for product "Enterprise Communications Broker"
pcz3.1
Search vendor "Oracle" for product "Enterprise Communications Broker" and version "pcz3.1"
-
Affected
Oracle
Search vendor "Oracle"
Enterprise Communications Broker
Search vendor "Oracle" for product "Enterprise Communications Broker"
pcz3.2
Search vendor "Oracle" for product "Enterprise Communications Broker" and version "pcz3.2"
-
Affected
Oracle
Search vendor "Oracle"
Enterprise Communications Broker
Search vendor "Oracle" for product "Enterprise Communications Broker"
pcz3.3
Search vendor "Oracle" for product "Enterprise Communications Broker" and version "pcz3.3"
-
Affected
Oracle
Search vendor "Oracle"
Enterprise Manager Base Platform
Search vendor "Oracle" for product "Enterprise Manager Base Platform"
13.3.0.0
Search vendor "Oracle" for product "Enterprise Manager Base Platform" and version "13.3.0.0"
-
Affected
Oracle
Search vendor "Oracle"
Enterprise Manager Base Platform
Search vendor "Oracle" for product "Enterprise Manager Base Platform"
13.4.0.0
Search vendor "Oracle" for product "Enterprise Manager Base Platform" and version "13.4.0.0"
-
Affected
Oracle
Search vendor "Oracle"
Enterprise Manager For Storage Management
Search vendor "Oracle" for product "Enterprise Manager For Storage Management"
13.4.0.0
Search vendor "Oracle" for product "Enterprise Manager For Storage Management" and version "13.4.0.0"
-
Affected
Oracle
Search vendor "Oracle"
Enterprise Manager Ops Center
Search vendor "Oracle" for product "Enterprise Manager Ops Center"
12.4.0.0
Search vendor "Oracle" for product "Enterprise Manager Ops Center" and version "12.4.0.0"
-
Affected
Oracle
Search vendor "Oracle"
Enterprise Session Border Controller
Search vendor "Oracle" for product "Enterprise Session Border Controller"
cz8.2
Search vendor "Oracle" for product "Enterprise Session Border Controller" and version "cz8.2"
-
Affected
Oracle
Search vendor "Oracle"
Enterprise Session Border Controller
Search vendor "Oracle" for product "Enterprise Session Border Controller"
cz8.3
Search vendor "Oracle" for product "Enterprise Session Border Controller" and version "cz8.3"
-
Affected
Oracle
Search vendor "Oracle"
Enterprise Session Border Controller
Search vendor "Oracle" for product "Enterprise Session Border Controller"
cz8.4
Search vendor "Oracle" for product "Enterprise Session Border Controller" and version "cz8.4"
-
Affected
Oracle
Search vendor "Oracle"
Essbase
Search vendor "Oracle" for product "Essbase"
21.2
Search vendor "Oracle" for product "Essbase" and version "21.2"
-
Affected
Oracle
Search vendor "Oracle"
Graalvm
Search vendor "Oracle" for product "Graalvm"
19.3.4
Search vendor "Oracle" for product "Graalvm" and version "19.3.4"
enterprise
Affected
Oracle
Search vendor "Oracle"
Graalvm
Search vendor "Oracle" for product "Graalvm"
20.3.0
Search vendor "Oracle" for product "Graalvm" and version "20.3.0"
enterprise
Affected
Oracle
Search vendor "Oracle"
Http Server
Search vendor "Oracle" for product "Http Server"
12.2.1.4.0
Search vendor "Oracle" for product "Http Server" and version "12.2.1.4.0"
-
Affected
Oracle
Search vendor "Oracle"
Jd Edwards Enterpriseone Tools
Search vendor "Oracle" for product "Jd Edwards Enterpriseone Tools"
< 9.2.5.3
Search vendor "Oracle" for product "Jd Edwards Enterpriseone Tools" and version " < 9.2.5.3"
-
Affected
Oracle
Search vendor "Oracle"
Jd Edwards World Security
Search vendor "Oracle" for product "Jd Edwards World Security"
a9.4
Search vendor "Oracle" for product "Jd Edwards World Security" and version "a9.4"
-
Affected
Oracle
Search vendor "Oracle"
Mysql
Search vendor "Oracle" for product "Mysql"
<= 8.0.22
Search vendor "Oracle" for product "Mysql" and version " <= 8.0.22"
-
Affected
Oracle
Search vendor "Oracle"
Mysql Server
Search vendor "Oracle" for product "Mysql Server"
<= 5.7.32
Search vendor "Oracle" for product "Mysql Server" and version " <= 5.7.32"
-
Affected
Oracle
Search vendor "Oracle"
Mysql Server
Search vendor "Oracle" for product "Mysql Server"
>= 8.0.15 <= 8.0.22
Search vendor "Oracle" for product "Mysql Server" and version " >= 8.0.15 <= 8.0.22"
-
Affected
Oracle
Search vendor "Oracle"
Peoplesoft Enterprise Peopletools
Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools"
8.56
Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" and version "8.56"
-
Affected
Oracle
Search vendor "Oracle"
Peoplesoft Enterprise Peopletools
Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools"
8.57
Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" and version "8.57"
-
Affected
Oracle
Search vendor "Oracle"
Peoplesoft Enterprise Peopletools
Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools"
8.58
Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" and version "8.58"
-
Affected
Netapp
Search vendor "Netapp"
Active Iq Unified Manager
Search vendor "Netapp" for product "Active Iq Unified Manager"
-vmware_vsphere
Affected
Netapp
Search vendor "Netapp"
Active Iq Unified Manager
Search vendor "Netapp" for product "Active Iq Unified Manager"
-windows
Affected
Netapp
Search vendor "Netapp"
Clustered Data Ontap Antivirus Connector
Search vendor "Netapp" for product "Clustered Data Ontap Antivirus Connector"
--
Affected
Netapp
Search vendor "Netapp"
Data Ontap
Search vendor "Netapp" for product "Data Ontap"
-7-mode
Affected
Netapp
Search vendor "Netapp"
E-series Santricity Os Controller
Search vendor "Netapp" for product "E-series Santricity Os Controller"
>= 11.0.0 <= 11.60.3
Search vendor "Netapp" for product "E-series Santricity Os Controller" and version " >= 11.0.0 <= 11.60.3"
-
Affected
Netapp
Search vendor "Netapp"
Hci Management Node
Search vendor "Netapp" for product "Hci Management Node"
--
Affected
Netapp
Search vendor "Netapp"
Manageability Software Development Kit
Search vendor "Netapp" for product "Manageability Software Development Kit"
--
Affected
Netapp
Search vendor "Netapp"
Oncommand Insight
Search vendor "Netapp" for product "Oncommand Insight"
--
Affected
Netapp
Search vendor "Netapp"
Oncommand Workflow Automation
Search vendor "Netapp" for product "Oncommand Workflow Automation"
--
Affected
Netapp
Search vendor "Netapp"
Plug-in For Symantec Netbackup
Search vendor "Netapp" for product "Plug-in For Symantec Netbackup"
--
Affected
Netapp
Search vendor "Netapp"
Santricity Smi-s Provider
Search vendor "Netapp" for product "Santricity Smi-s Provider"
--
Affected
Netapp
Search vendor "Netapp"
Snapcenter
Search vendor "Netapp" for product "Snapcenter"
--
Affected
Netapp
Search vendor "Netapp"
Solidfire
Search vendor "Netapp" for product "Solidfire"
--
Affected
Netapp
Search vendor "Netapp"
Hci Compute Node
Search vendor "Netapp" for product "Hci Compute Node"
--
Affected
Netapp
Search vendor "Netapp"
Hci Storage Node
Search vendor "Netapp" for product "Hci Storage Node"
--
Affected
Tenable
Search vendor "Tenable"
Log Correlation Engine
Search vendor "Tenable" for product "Log Correlation Engine"
< 6.0.9
Search vendor "Tenable" for product "Log Correlation Engine" and version " < 6.0.9"
-
Affected
Tenable
Search vendor "Tenable"
Nessus Network Monitor
Search vendor "Tenable" for product "Nessus Network Monitor"
< 5.13.1
Search vendor "Tenable" for product "Nessus Network Monitor" and version " < 5.13.1"
-
Affected
Siemens
Search vendor "Siemens"
Sinec Infrastructure Network Services
Search vendor "Siemens" for product "Sinec Infrastructure Network Services"
< 1.0.1.1
Search vendor "Siemens" for product "Sinec Infrastructure Network Services" and version " < 1.0.1.1"
-
Affected
Nodejs
Search vendor "Nodejs"
Node.js
Search vendor "Nodejs" for product "Node.js"
>= 10.0.0 <= 10.12.0
Search vendor "Nodejs" for product "Node.js" and version " >= 10.0.0 <= 10.12.0"
-
Affected
Nodejs
Search vendor "Nodejs"
Node.js
Search vendor "Nodejs" for product "Node.js"
>= 10.13.0 < 10.23.1
Search vendor "Nodejs" for product "Node.js" and version " >= 10.13.0 < 10.23.1"
lts
Affected
Nodejs
Search vendor "Nodejs"
Node.js
Search vendor "Nodejs" for product "Node.js"
>= 12.0.0 <= 12.12.0
Search vendor "Nodejs" for product "Node.js" and version " >= 12.0.0 <= 12.12.0"
-
Affected
Nodejs
Search vendor "Nodejs"
Node.js
Search vendor "Nodejs" for product "Node.js"
>= 12.13.0 < 12.20.1
Search vendor "Nodejs" for product "Node.js" and version " >= 12.13.0 < 12.20.1"
lts
Affected
Nodejs
Search vendor "Nodejs"
Node.js
Search vendor "Nodejs" for product "Node.js"
>= 14.0.0 <= 14.14.0
Search vendor "Nodejs" for product "Node.js" and version " >= 14.0.0 <= 14.14.0"
-
Affected
Nodejs
Search vendor "Nodejs"
Node.js
Search vendor "Nodejs" for product "Node.js"
>= 14.15.0 < 14.15.4
Search vendor "Nodejs" for product "Node.js" and version " >= 14.15.0 < 14.15.4"
lts
Affected
Nodejs
Search vendor "Nodejs"
Node.js
Search vendor "Nodejs" for product "Node.js"
>= 15.0.0 < 15.5.0
Search vendor "Nodejs" for product "Node.js" and version " >= 15.0.0 < 15.5.0"
-
Affected