CVE-2020-1967: broadcom fabric_operating_system NULL Pointer Dereference
CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2020-1967SUSE-SU-2020:1058-1SUSE-SU-2020:2041-1UBUNTU-CVE-2020-1967DEBIAN-CVE-2020-1967DSA-4661-1openSUSE-SU-2020:0933-1openSUSE-SU-2020:0945-1CGA-2vp6-8gw4-747jCGA-36wg-969v-gvcxCGA-6mph-p22f-63h6CGA-724m-rjp9-c7fxCGA-7p4w-48xq-m47wCGA-cqc6-32r5-fm94CGA-f2xm-6mmj-wc4pCGA-f8h8-8cf9-h3g5CGA-g365-cghr-jwghCGA-jmcj-9xg2-f2wfCGA-mmp9-fvpj-qrwwGHSA-jq65-29v4-4x35RUSTSEC-2020-0015CGA-q49r-f53w-4x7h
Published 21-04-2020Last modified 08-10-2026
Vulnerability summary
CVE-2020-1967 is a high (CVSS 7.5) NULL Pointer Dereference vulnerability in broadcom fabric_operating_system. EPSS estimates a 53.34% chance of exploitation in the next 30 days, higher than 98.9% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
7.5/10
010
High · v3.1 (NVD)EPSS score
53.34%
0%100%
Critical · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 2 · Related 4Timeline
- 21-04-2020PublishedVulnerability first disclosed.
- 08-10-2026Last modifiedVulnerability information updated.
Description
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Fixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f).
CVSS metrics
7 scores · 6 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 6 agree
- OSV · AlpineEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · Crates.ioEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 5.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
53.34%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 53.34% on 18-09-2026
18-09-202618-10-2026
EPSS score53.34%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundCve 2020 1967
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Oracle11 products
- application_server12.1.3
- enterprise_manager_base_platform13.4.0.0
- enterprise_manager_for_storage_management13.3.0.0 | 13.4.0.0
- enterprise_manager_ops_center12.4.0
- http_server12.2.1.4.0
Suse8 products
- openssl-1_1&distro=SUSE Linux Enterprise Server 12 SP4< 1.1.1d-2.23.1
- openssl-1_1&distro=SUSE Linux Enterprise Server 12 SP5< 1.1.1d-2.23.1
- openssl-1_1&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 1.1.1d-2.23.1
- openssl-1_1&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 1.1.1d-2.23.1
- openssl-1_1&distro=SUSE Linux Enterprise Software Development Kit 12 SP4< 1.1.1d-2.23.1
Netapp7 products
- active_iq_unified_manager≥ 7.3 (No fix recorded) | ≥ 9.5 (No fix recorded)
- e-series_performance_analyzerna
- oncommand_insightna
- oncommand_workflow_automationna
- smi-s_providerna
Chainguard6 products
- mysql-8.0< 8.0.38-r0
- mysql-8.0-client< 8.0.38-r0
- mysql-8.0-dev< 8.0.38-r0
- mysql-8.0-iamguarded-compat< 8.0.38-r0
- mysql-8.0-oci-entrypoint< 8.0.38-r0
Opensuse5 products
- leapEOL15.1 | 15.2
- rust-cbindgen&distro=openSUSE Leap 15.1< 0.14.1-lp151.8.2
- rust-cbindgen&distro=openSUSE Leap 15.2< 0.14.1-lp152.2.4.1
- rust&distro=openSUSE Leap 15.1< 1.43.1-lp151.5.13.1
- rust&distro=openSUSE Leap 15.2< 1.43.1-lp152.3.5.1
Alpine2 products
- openssl≥ 1.1.1d, < 1.1.1g-r0
- openssl3< 1.1.1g-r0
Debian2 products
- openssl< 1.1.1g-1 | < 1.1.1d-0+deb10u3
- debian_linuxEOL9.0 | 10.0
Broadcom1 product
Crates.Io1 product
- openssl-src≥ 111.6.0, < 111.9.0
Fedoraproject1 product
- fedoraEOL30 | 31 | 32
Freebsd1 product
- freebsdEOL12.1
Jdedwards1 product
- enterpriseone< 9.2.5.0
Openssl1 product
- opensslFixed in OpenSSL 1.1.1g (Affected 1.1.1d-1.1.1f) | ≥ 1.1.1d, ≤ 1.1.1f
Tenable1 product
- log_correlation_engine< 6.0.9
Ubuntu1 product
- openssl< 1.1.1f-1ubuntu2
15 vendors · 49 products
References
57 links- security.freebsd.org/advisories/FreeBSD-SA-20:11.openssl.ascVendor AdvisoryX Refsource FREEBSDFIXWEBPatchThird Party Advisory
www.debian.org/security/2020/dsa-4661Vendor AdvisoryX Refsource DEBIANAdvisoryWEBThird Party Advisory- www.openwall.com/lists/oss-security/2020/04/22/2Mailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
- seclists.org/fulldisclosure/2020/May/5Mailing ListX Refsource FULLDISCAdvisoryWEBThird Party Advisory
Show all 57 references
- lists.opensuse.org/opensuse-security-announce/2020-07/msg00004.htmlVendor AdvisoryX Refsource SUSEAdvisoryWEBMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2020-07/msg00011.htmlVendor AdvisoryX Refsource SUSEAdvisoryWEBMailing ListThird Party Advisory
- kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA44440X Refsource CONFIRMAdvisoryWEBThird Party Advisory
- www.synology.com/security/advisory/Synology_SA_20_05_OpenSSLX Refsource CONFIRMAdvisoryWEBThird Party Advisory
- packetstormsecurity.com/files/157527/OpenSSL-signature_algorithms_cert-Denial-Of-Service.htmlX Refsource MISCAdvisoryWEBThird Party AdvisoryVDB Entry
- www.synology.com/security/advisory/Synology_SA_20_05X Refsource CONFIRMAdvisoryWEBThird Party Advisory
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory
- crates.io/crates/openssl-srcPACKAGE