OpenSSL Security Advisory

OpenSSL openssl at openssl.org Tue Apr 21 13:25:24 UTC 2020 Previous message: OpenSSL version 1.1.1g published Next message: OpenSSL version 3.0.0-alpha1 published Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 OpenSSL Security Advisory [21 April 2020] ========================================= Segmentation fault in SSL_check_chain (CV

[tetsutalow]

OpenSSL 1.1.1d～fに深刻な脆弱性。TLS1.3でのハンドシェイク時のsignature_algorithms_cert拡張の取扱いで無効なアルゴリズムを受け取るとSEGV例外で落ちる。GCC10で導入された-fanalyzerオプションでの静的解析が発見に役だったようだ。