{"id":"RUSTSEC-2020-0015","revision":"09bf9b8be0a442f58c3e2271755d533e","records":[{"revision":"09bf9b8be0a442f58c3e2271755d533e","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2020-0015","aliases":["CVE-2020-1967","GHSA-jq65-29v4-4x35"],"title":"Crash causing Denial of Service attack","description":"Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 \nhandshake may crash due to a NULL pointer dereference as a result of incorrect handling of the \n\"signature_algorithms_cert\" TLS extension. The crash occurs if an invalid or unrecognised signature \nalgorithm is received from the peer. This could be exploited by a malicious peer in a Denial of \nService attack.","state":0,"publishedAt":"2020-04-25T12:00:00+00:00","modifiedAt":"2024-07-15T22:00:19.808758+00:00","affected":[{"ecosystem":"crates.io","name":"openssl-src","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"111.6.0"},{"kind":"fixed","version":"111.9.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null}],"references":["https://crates.io/crates/openssl-src","https://rustsec.org/advisories/RUSTSEC-2020-0015.html","https://www.openssl.org/news/secadv/20200421.txt"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2020-0015","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2020-0015","identifiers":["RUSTSEC-2020-0015","CVE-2020-1967","GHSA-jq65-29v4-4x35"]},"retained":false,"historicalAffected":[]}],"coverage":[]}