Wind River Support Network

HomeSafety and Security NoticesWind River Security Vulnerability Notice: CVE-2020-1967

Wind River Security Vulnerability Notice: CVE-2020-1967

Released: Apr 22, 2020     Updated: Apr 22, 2020


Wind River Security Vulnerability Notice: CVE-2020-1967 of openssl

Affected Product Versions

Wind River Linux LTS 19, Wind River Linux LTS 18


Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. The crash occurs if an invalid or unrecognised signature algorithm is received from the peer. This could be exploited by a malicious peer in a Denial of Service attack. OpenSSL version 1.1.1d, 1.1.1e, and 1.1.1f are affected by this issue. This issue did not affect OpenSSL versions prior to 1.1.1d. Reported by Bernd Edlinger.

For more information, consult NVD at

What software is known to be affected by this CVE?

openssl 1.1.1d ~ 1.1.1f

Is Wind River Linux affected by this CVE issue?

WRLinux LTS-18 and LTS-19 are affected on it, all earlier releases have no this issue.

NOTE: LTS-18 supports several openssl versions, only 1.1.1d is affected.


Upstream commit eb563247 of openssl fixed it:

This commit can be integrated into openssl source tree of LTS-18/19 directly:

# git clone git://
# cd openssl
# git format-patch eb563247a -1
# cd PATH_2_PROJ/SOURCE_CODE_of_openssl
# patch -p1 <PATH_2_SOURCE/openssl/0001-Fix-NULL-dereference-in-SSL_check_chain-for-TLS-1.3.patch


Wind River will continue to monitor the various Open Source projects and will incorporate fixes as appropriate to supported products.

Live chat