CVE-2020-1971
EDIPARTYNAME NULL pointer dereference
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The X.509 GeneralName type is a generic type for representing different types of names. One of those name types is known as EDIPartyName. OpenSSL provides a function GENERAL_NAME_cmp which compares different instances of a GENERAL_NAME to see if they are equal or not. This function behaves incorrectly when both GENERAL_NAMEs contain an EDIPARTYNAME. A NULL pointer dereference and a crash may occur leading to a possible denial of service attack. OpenSSL itself uses the GENERAL_NAME_cmp function for two purposes: 1) Comparing CRL distribution point names between an available CRL and a CRL distribution point embedded in an X509 certificate 2) When verifying that a timestamp response token signer matches the timestamp authority name (exposed via the API functions TS_RESP_verify_response and TS_RESP_verify_token) If an attacker can control both items being compared then that attacker could trigger a crash. For example if the attacker can trick a client or server into checking a malicious certificate against a malicious CRL then this may occur. Note that some applications automatically download CRLs based on a URL embedded in a certificate. This checking happens prior to the signatures on the certificate and CRL being verified. OpenSSL's s_server, s_client and verify tools have support for the "-crl_download" option which implements automatic CRL downloading and this attack has been demonstrated to work against those tools. Note that an unrelated bug means that affected versions of OpenSSL cannot parse or construct correct encodings of EDIPARTYNAME. However it is possible to construct a malformed EDIPARTYNAME that OpenSSL's parser will accept and hence trigger this attack. All OpenSSL 1.1.1 and 1.0.2 versions are affected by this issue. Other OpenSSL releases are out of support and have not been checked. Fixed in OpenSSL 1.1.1i (Affected 1.1.1-1.1.1h). Fixed in OpenSSL 1.0.2x (Affected 1.0.2-1.0.2w).
El tipo GeneralName X.509 es un tipo genérico para representar diferentes tipos de nombres. Uno de esos tipos de nombres se conoce como EDIPartyName. OpenSSL proporciona una función GENERAL_NAME_cmp que compara diferentes instancias de GENERAL_NAME para ver si son iguales o no. Esta función se comporta incorrectamente cuando ambos GENERAL_NAME contienen un EDIPARTYNAME. Es posible que se produzca una desreferencia del puntero NULL y un bloqueo que conduzca a un posible ataque de denegación de servicio. El propio OpenSSL usa la función GENERAL_NAME_cmp para dos propósitos: 1) Comparación de nombres de puntos de distribución de CRL entre una CRL disponible y un punto de distribución de CRL insertado en un certificado X509 2) Al comparar que un firmante de token de respuesta de marca de tiempo coincide con el nombre de autoridad de marca de tiempo (expuesto por medio de las funciones API TS_RESP_verify_response y TS_RESP_verify_token) Si un atacante puede controlar ambos elementos que se están comparando, entonces ese atacante podría desencadenar un bloqueo. Por ejemplo, si el atacante puede engañar a un cliente o servidor para que compruebe un certificado malicioso con una CRL maliciosa, esto puede ocurrir. Tome en cuenta que algunas aplicaciones descargan automáticamente las CRL basadas en una URL insertada en un certificado. Esta comprobación ocurre antes de que se verifiquen las firmas en el certificado y la CRL. Las herramientas s_server, s_client y verify de OpenSSL tienen soporte para la opción "-crl_download" que implementa la descarga automática de CRL y se ha demostrado que este ataque funciona contra esas herramientas. Tome en cuenta que un error no relacionado significa que las versiones afectadas de OpenSSL no pueden analizar ni construir codificaciones correctas de EDIPARTYNAME. Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptará y, por lo tanto, desencadenará este ataque. Todas las versiones de OpenSSL 1.1.1 y 1.0.2 están afectadas por este problema. Otras versiones de OpenSSL no son compatibles y no se han comprobado. Corregido en OpenSSL versiones 1.1.1i (Afectado versiones 1.1.1-1.1.1h). Corregido en OpenSSL versiones 1.0.2x (Afectado versiones 1.0.2-1.0.2w). Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptará y, por lo tanto, desencadenará este ataque. Todas las versiones de OpenSSL 1.1.1 y 1.0.2 están afectadas por este problema. Otras versiones de OpenSSL no son compatibles y no se han comprobado. Corregido en OpenSSL versión 1.1.1i (Afectada versión 1.1.1-1.1.1h). Corregido en OpenSSL versión 1.0.2x (Afectada versión 1.0.2-1.0.2w). Sin embargo, es posible construir un EDIPARTYNAME malformado que el analizador de OpenSSL aceptará y, por lo tanto, desencadenará este ataque. Todas las versiones de OpenSSL 1.1.1 y 1.0.2 están afectadas por este problema. Otras versiones de OpenSSL no son compatibles y no se han comprobado. Corregido en OpenSSL versión 1.1.1i (Afectada versión 1.1.1-1.1.1h). Corregido en OpenSSL versión 1.0.2x (Afectada versión 1.0.2-1.0.2w)
A null pointer dereference flaw was found in openssl. A remote attacker, able to control the arguments of the GENERAL_NAME_cmp function, could cause the application, compiled with openssl to crash resulting in a denial of service. The highest threat from this vulnerability is to system availability.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-12-03 CVE Reserved
- 2020-12-08 CVE Published
- 2020-12-10 First Exploit
- 2024-09-17 CVE Updated
- 2024-10-29 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-476: NULL Pointer Dereference
CAPEC
References (29)
URL | Date | SRC |
---|---|---|
https://github.com/MBHudson/CVE-2020-1971 | 2020-12-10 |
URL | Date | SRC |
---|---|---|
https://www.oracle.com//security-alerts/cpujul2021.html | 2024-06-21 | |
https://www.oracle.com/security-alerts/cpuApr2021.html | 2024-06-21 | |
https://www.oracle.com/security-alerts/cpuapr2022.html | 2024-06-21 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Netapp Search vendor "Netapp" | Ef600a Firmware Search vendor "Netapp" for product "Ef600a Firmware" | - | - |
Affected
| in | Netapp Search vendor "Netapp" | Ef600a Search vendor "Netapp" for product "Ef600a" | - | - |
Safe
|
Netapp Search vendor "Netapp" | Aff A250 Firmware Search vendor "Netapp" for product "Aff A250 Firmware" | - | - |
Affected
| in | Netapp Search vendor "Netapp" | Aff A250 Search vendor "Netapp" for product "Aff A250" | - | - |
Safe
|
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | >= 1.0.2 < 1.0.2x Search vendor "Openssl" for product "Openssl" and version " >= 1.0.2 < 1.0.2x" | - |
Affected
| ||||||
Openssl Search vendor "Openssl" | Openssl Search vendor "Openssl" for product "Openssl" | >= 1.1.1 < 1.1.1i Search vendor "Openssl" for product "Openssl" and version " >= 1.1.1 < 1.1.1i" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 9.0 Search vendor "Debian" for product "Debian Linux" and version "9.0" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 32 Search vendor "Fedoraproject" for product "Fedora" and version "32" | - |
Affected
| ||||||
Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 33 Search vendor "Fedoraproject" for product "Fedora" and version "33" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Api Gateway Search vendor "Oracle" for product "Api Gateway" | 11.1.2.4.0 Search vendor "Oracle" for product "Api Gateway" and version "11.1.2.4.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Business Intelligence Search vendor "Oracle" for product "Business Intelligence" | 5.5.0.0.0 Search vendor "Oracle" for product "Business Intelligence" and version "5.5.0.0.0" | enterprise |
Affected
| ||||||
Oracle Search vendor "Oracle" | Business Intelligence Search vendor "Oracle" for product "Business Intelligence" | 5.9.0.0.0 Search vendor "Oracle" for product "Business Intelligence" and version "5.9.0.0.0" | enterprise |
Affected
| ||||||
Oracle Search vendor "Oracle" | Business Intelligence Search vendor "Oracle" for product "Business Intelligence" | 12.2.1.3.0 Search vendor "Oracle" for product "Business Intelligence" and version "12.2.1.3.0" | enterprise |
Affected
| ||||||
Oracle Search vendor "Oracle" | Business Intelligence Search vendor "Oracle" for product "Business Intelligence" | 12.2.1.4.0 Search vendor "Oracle" for product "Business Intelligence" and version "12.2.1.4.0" | enterprise |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Cloud Native Core Network Function Cloud Native Environment Search vendor "Oracle" for product "Communications Cloud Native Core Network Function Cloud Native Environment" | 1.10.0 Search vendor "Oracle" for product "Communications Cloud Native Core Network Function Cloud Native Environment" and version "1.10.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Diameter Intelligence Hub Search vendor "Oracle" for product "Communications Diameter Intelligence Hub" | >= 8.0.0 <= 8.1.0 Search vendor "Oracle" for product "Communications Diameter Intelligence Hub" and version " >= 8.0.0 <= 8.1.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Diameter Intelligence Hub Search vendor "Oracle" for product "Communications Diameter Intelligence Hub" | >= 8.2.0 <= 8.2.3 Search vendor "Oracle" for product "Communications Diameter Intelligence Hub" and version " >= 8.2.0 <= 8.2.3" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Session Border Controller Search vendor "Oracle" for product "Communications Session Border Controller" | cz8.2 Search vendor "Oracle" for product "Communications Session Border Controller" and version "cz8.2" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Session Border Controller Search vendor "Oracle" for product "Communications Session Border Controller" | cz8.3 Search vendor "Oracle" for product "Communications Session Border Controller" and version "cz8.3" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Session Border Controller Search vendor "Oracle" for product "Communications Session Border Controller" | cz8.4 Search vendor "Oracle" for product "Communications Session Border Controller" and version "cz8.4" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Session Router Search vendor "Oracle" for product "Communications Session Router" | cz8.2 Search vendor "Oracle" for product "Communications Session Router" and version "cz8.2" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Session Router Search vendor "Oracle" for product "Communications Session Router" | cz8.3 Search vendor "Oracle" for product "Communications Session Router" and version "cz8.3" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Session Router Search vendor "Oracle" for product "Communications Session Router" | cz8.4 Search vendor "Oracle" for product "Communications Session Router" and version "cz8.4" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Subscriber-aware Load Balancer Search vendor "Oracle" for product "Communications Subscriber-aware Load Balancer" | cz8.2 Search vendor "Oracle" for product "Communications Subscriber-aware Load Balancer" and version "cz8.2" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Subscriber-aware Load Balancer Search vendor "Oracle" for product "Communications Subscriber-aware Load Balancer" | cz8.3 Search vendor "Oracle" for product "Communications Subscriber-aware Load Balancer" and version "cz8.3" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Subscriber-aware Load Balancer Search vendor "Oracle" for product "Communications Subscriber-aware Load Balancer" | cz8.4 Search vendor "Oracle" for product "Communications Subscriber-aware Load Balancer" and version "cz8.4" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Communications Unified Session Manager Search vendor "Oracle" for product "Communications Unified Session Manager" | scz8.2.5 Search vendor "Oracle" for product "Communications Unified Session Manager" and version "scz8.2.5" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Enterprise Communications Broker Search vendor "Oracle" for product "Enterprise Communications Broker" | pcz3.1 Search vendor "Oracle" for product "Enterprise Communications Broker" and version "pcz3.1" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Enterprise Communications Broker Search vendor "Oracle" for product "Enterprise Communications Broker" | pcz3.2 Search vendor "Oracle" for product "Enterprise Communications Broker" and version "pcz3.2" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Enterprise Communications Broker Search vendor "Oracle" for product "Enterprise Communications Broker" | pcz3.3 Search vendor "Oracle" for product "Enterprise Communications Broker" and version "pcz3.3" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Enterprise Manager Base Platform Search vendor "Oracle" for product "Enterprise Manager Base Platform" | 13.3.0.0 Search vendor "Oracle" for product "Enterprise Manager Base Platform" and version "13.3.0.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Enterprise Manager Base Platform Search vendor "Oracle" for product "Enterprise Manager Base Platform" | 13.4.0.0 Search vendor "Oracle" for product "Enterprise Manager Base Platform" and version "13.4.0.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Enterprise Manager For Storage Management Search vendor "Oracle" for product "Enterprise Manager For Storage Management" | 13.4.0.0 Search vendor "Oracle" for product "Enterprise Manager For Storage Management" and version "13.4.0.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Enterprise Manager Ops Center Search vendor "Oracle" for product "Enterprise Manager Ops Center" | 12.4.0.0 Search vendor "Oracle" for product "Enterprise Manager Ops Center" and version "12.4.0.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Enterprise Session Border Controller Search vendor "Oracle" for product "Enterprise Session Border Controller" | cz8.2 Search vendor "Oracle" for product "Enterprise Session Border Controller" and version "cz8.2" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Enterprise Session Border Controller Search vendor "Oracle" for product "Enterprise Session Border Controller" | cz8.3 Search vendor "Oracle" for product "Enterprise Session Border Controller" and version "cz8.3" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Enterprise Session Border Controller Search vendor "Oracle" for product "Enterprise Session Border Controller" | cz8.4 Search vendor "Oracle" for product "Enterprise Session Border Controller" and version "cz8.4" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Essbase Search vendor "Oracle" for product "Essbase" | 21.2 Search vendor "Oracle" for product "Essbase" and version "21.2" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Graalvm Search vendor "Oracle" for product "Graalvm" | 19.3.4 Search vendor "Oracle" for product "Graalvm" and version "19.3.4" | enterprise |
Affected
| ||||||
Oracle Search vendor "Oracle" | Graalvm Search vendor "Oracle" for product "Graalvm" | 20.3.0 Search vendor "Oracle" for product "Graalvm" and version "20.3.0" | enterprise |
Affected
| ||||||
Oracle Search vendor "Oracle" | Http Server Search vendor "Oracle" for product "Http Server" | 12.2.1.4.0 Search vendor "Oracle" for product "Http Server" and version "12.2.1.4.0" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Jd Edwards Enterpriseone Tools Search vendor "Oracle" for product "Jd Edwards Enterpriseone Tools" | < 9.2.5.3 Search vendor "Oracle" for product "Jd Edwards Enterpriseone Tools" and version " < 9.2.5.3" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Jd Edwards World Security Search vendor "Oracle" for product "Jd Edwards World Security" | a9.4 Search vendor "Oracle" for product "Jd Edwards World Security" and version "a9.4" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Mysql Search vendor "Oracle" for product "Mysql" | <= 8.0.22 Search vendor "Oracle" for product "Mysql" and version " <= 8.0.22" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Mysql Server Search vendor "Oracle" for product "Mysql Server" | <= 5.7.32 Search vendor "Oracle" for product "Mysql Server" and version " <= 5.7.32" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Mysql Server Search vendor "Oracle" for product "Mysql Server" | >= 8.0.15 <= 8.0.22 Search vendor "Oracle" for product "Mysql Server" and version " >= 8.0.15 <= 8.0.22" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Peoplesoft Enterprise Peopletools Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" | 8.56 Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" and version "8.56" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Peoplesoft Enterprise Peopletools Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" | 8.57 Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" and version "8.57" | - |
Affected
| ||||||
Oracle Search vendor "Oracle" | Peoplesoft Enterprise Peopletools Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" | 8.58 Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" and version "8.58" | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager" | - | vmware_vsphere |
Affected
| ||||||
Netapp Search vendor "Netapp" | Active Iq Unified Manager Search vendor "Netapp" for product "Active Iq Unified Manager" | - | windows |
Affected
| ||||||
Netapp Search vendor "Netapp" | Clustered Data Ontap Antivirus Connector Search vendor "Netapp" for product "Clustered Data Ontap Antivirus Connector" | - | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Data Ontap Search vendor "Netapp" for product "Data Ontap" | - | 7-mode |
Affected
| ||||||
Netapp Search vendor "Netapp" | E-series Santricity Os Controller Search vendor "Netapp" for product "E-series Santricity Os Controller" | >= 11.0.0 <= 11.60.3 Search vendor "Netapp" for product "E-series Santricity Os Controller" and version " >= 11.0.0 <= 11.60.3" | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Hci Management Node Search vendor "Netapp" for product "Hci Management Node" | - | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Manageability Software Development Kit Search vendor "Netapp" for product "Manageability Software Development Kit" | - | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Oncommand Insight Search vendor "Netapp" for product "Oncommand Insight" | - | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Oncommand Workflow Automation Search vendor "Netapp" for product "Oncommand Workflow Automation" | - | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Plug-in For Symantec Netbackup Search vendor "Netapp" for product "Plug-in For Symantec Netbackup" | - | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Santricity Smi-s Provider Search vendor "Netapp" for product "Santricity Smi-s Provider" | - | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Snapcenter Search vendor "Netapp" for product "Snapcenter" | - | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Solidfire Search vendor "Netapp" for product "Solidfire" | - | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Hci Compute Node Search vendor "Netapp" for product "Hci Compute Node" | - | - |
Affected
| ||||||
Netapp Search vendor "Netapp" | Hci Storage Node Search vendor "Netapp" for product "Hci Storage Node" | - | - |
Affected
| ||||||
Tenable Search vendor "Tenable" | Log Correlation Engine Search vendor "Tenable" for product "Log Correlation Engine" | < 6.0.9 Search vendor "Tenable" for product "Log Correlation Engine" and version " < 6.0.9" | - |
Affected
| ||||||
Tenable Search vendor "Tenable" | Nessus Network Monitor Search vendor "Tenable" for product "Nessus Network Monitor" | < 5.13.1 Search vendor "Tenable" for product "Nessus Network Monitor" and version " < 5.13.1" | - |
Affected
| ||||||
Siemens Search vendor "Siemens" | Sinec Infrastructure Network Services Search vendor "Siemens" for product "Sinec Infrastructure Network Services" | < 1.0.1.1 Search vendor "Siemens" for product "Sinec Infrastructure Network Services" and version " < 1.0.1.1" | - |
Affected
| ||||||
Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | >= 10.0.0 <= 10.12.0 Search vendor "Nodejs" for product "Node.js" and version " >= 10.0.0 <= 10.12.0" | - |
Affected
| ||||||
Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | >= 10.13.0 < 10.23.1 Search vendor "Nodejs" for product "Node.js" and version " >= 10.13.0 < 10.23.1" | lts |
Affected
| ||||||
Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | >= 12.0.0 <= 12.12.0 Search vendor "Nodejs" for product "Node.js" and version " >= 12.0.0 <= 12.12.0" | - |
Affected
| ||||||
Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | >= 12.13.0 < 12.20.1 Search vendor "Nodejs" for product "Node.js" and version " >= 12.13.0 < 12.20.1" | lts |
Affected
| ||||||
Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | >= 14.0.0 <= 14.14.0 Search vendor "Nodejs" for product "Node.js" and version " >= 14.0.0 <= 14.14.0" | - |
Affected
| ||||||
Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | >= 14.15.0 < 14.15.4 Search vendor "Nodejs" for product "Node.js" and version " >= 14.15.0 < 14.15.4" | lts |
Affected
| ||||||
Nodejs Search vendor "Nodejs" | Node.js Search vendor "Nodejs" for product "Node.js" | >= 15.0.0 < 15.5.0 Search vendor "Nodejs" for product "Node.js" and version " >= 15.0.0 < 15.5.0" | - |
Affected
|