Lucene search

K
freebsdFreeBSD012809CE-83F3-11EA-92AB-00163E433440
HistoryApr 21, 2020 - 12:00 a.m.

OpenSSL remote denial of service vulnerability

2020-04-2100:00:00
vuxml.freebsd.org
69

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.081 Low

EPSS

Percentile

94.2%

Problem Description:
Server or client applications that call the SSL_check_chain()
function during or after a TLS 1.3 handshake may crash due to a NULL
pointer dereference as a result of incorrect handling of the
“signature_algorithms_cert” TLS extension. The crash occurs if an
invalid or unrecognized signature algorithm is received from the
peer.
Impact:
A malicious peer could exploit the NULL pointer dereference crash,
causing a denial of service attack.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchfreebsd= 12.1UNKNOWN
FreeBSDanynoarchfreebsd< 12.1_4UNKNOWN
FreeBSDanynoarchopenssl= 1.1.1,1UNKNOWN
FreeBSDanynoarchopenssl< 1.1.1g,1UNKNOWN

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.081 Low

EPSS

Percentile

94.2%