CVE-2020-1967

Red Hat statement

This flaw was introduced by the following OpenSSL commit: https://github.com/openssl/openssl/commit/5235ef44b93306a14d0b6c695b13c64b16e1fdec which was shipped as a part of OpenSSL-1.1.1d, therefore older versions are not affected by this flaw. OpenSSL packages shipped with Red Hat Products are NOT affected by this flaw. The affected `signature_algorithm_cert` check which causes the flaw is only applied to TLS 1.3, therefore older versions of TLS are not be affected by this flaw. Also, the vulnerable `SSL_check_chain()` is not called directly from libssl, but may be used by the application inside a callback (e.g., client_hello or cert callback) to verify that a candidate certificate chain will be acceptable to the client. Thus, applications that use openssl without invoking the `SSL_check_chain()` function are not vulnerable to this flaw. Lastly, no Red Hat Middleware products ship the affected version of OpenSSL. However, some components, such as Netty and Wildfly, may be configured by customers to use any OpenSSL version. Customers who have configured their setups to use a vulnerable version of OpenSSL are advised to upgrade to the latest unaffected version immediately.

Red Hat mitigation

Applications compiled with OpenSSL >= 1.1.1d that either use openssl without invoking the `SSL_check_chain()` function or do not use TLS 1.3 are not vulnerable to this flaw.