低危 OpenSSL：CVE-2020-1971 EDIPARTYNAME 空指针间接引用
CVE编号
CVE-2020-1971利用情况
POC 已公开补丁情况
官方补丁披露时间
2021-10-12漏洞描述
OpenSSL是Openssl团队的一个开源的能够实现安全套接层（SSLv2/v3）和安全传输层（TLSv1）协议的通用加密库。该产品支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL 1.1.1版本和1.0.2版本存在安全漏洞，该漏洞源于空指针解引用和崩溃可能会导致拒绝服务攻击。解决建议
建议您更新当前系统或软件至最新版，完成漏洞的修复。受影响软件情况
| # | 类型 | 厂商 | 产品 | 版本 | 影响面 | ||||
| 1 | |||||||||
|---|---|---|---|---|---|---|---|---|---|
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | * | From (including) 1.0.2 | Up to (including) 1.0.2w | ||||
| 运行在以下环境 | |||||||||
| 应用 | openssl | openssl | * | From (including) 1.1.1 | Up to (including) 1.1.1h | ||||
| 运行在以下环境 | |||||||||
| 系统 | alibaba_cloud_linux_2.1903 | openssl-libs | * | Up to (excluding) 1.0.2k-21.1.al7 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.10 | openssl | * | Up to (excluding) 1.1.1i-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.11 | openssl | * | Up to (excluding) 1.1.1i-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.12 | openssl | * | Up to (excluding) 1.1.1i-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.13 | libressl | * | Up to (excluding) 3.1.5-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.14 | libressl | * | Up to (excluding) 1.1.1i-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.15 | libressl | * | Up to (excluding) 1.1.1i-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.16 | libressl | * | Up to (excluding) 1.1.1i-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.17 | libressl | * | Up to (excluding) 3.1.5-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.18 | libressl | * | Up to (excluding) 3.1.5-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_3.9 | openssl | * | Up to (excluding) 1.1.1i-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | alpine_edge | libressl | * | Up to (excluding) 1.1.1i-r0 | |||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_2 | openssl | * | Up to (excluding) 1.0.2k-19.amzn2.0.4 | |||||
| 运行在以下环境 | |||||||||
| 系统 | amazon_AMI | openssl | * | Up to (excluding) 1.0.2k-16.152.amzn1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | centos_7 | openssl | * | Up to (excluding) 1.0.2k-21.el7_9 | |||||
| 运行在以下环境 | |||||||||
| 系统 | centos_8 | openssl-devel | * | Up to (excluding) 1.1.1g-12.el8_3 | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_10 | openssl | * | Up to (excluding) 1.1.1d-0+deb10u4 | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_11 | openssl | * | Up to (excluding) 1.1.1i-1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_12 | openssl | * | Up to (excluding) 1.1.1i-1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_9 | openssl | * | Up to (excluding) 1.1.0l-1~deb9u2 | |||||
| 运行在以下环境 | |||||||||
| 系统 | debian_sid | openssl | * | Up to (excluding) 1.1.1i-1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_32 | openssl-libs-debuginfo | * | Up to (excluding) 1.1.1i-1.fc32 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_33 | openssl-libs-debuginfo | * | Up to (excluding) 1.1.1i-1.fc33 | |||||
| 运行在以下环境 | |||||||||
| 系统 | fedora_EPEL_7 | openssl11 | * | Up to (excluding) 1.1.1g-2.el7 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_aarch64_V10 | openssl | * | Up to (excluding) 1.0.2k-21.el7_9.ns7.01 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_aarch64_V10SP1 | shim | * | Up to (excluding) 1.1.1f-4.p01.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_aarch64_V10SP2 | shim | * | Up to (excluding) 1.1.1f-4.p01.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_loongarch64_V10SP1 | openssl | * | Up to (excluding) 1.1.1f-4.p09.a.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_x86_64_V10 | openssl | * | Up to (excluding) 1.0.2k-21.el7_9.ns7.01 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_x86_64_V10SP1 | shim | * | Up to (excluding) 1.1.1f-4.p01.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | kylinos_x86_64_V10SP2 | shim | * | Up to (excluding) 1.1.1f-4.p01.ky10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.1 | nodejs10 | * | Up to (excluding) 1.0.2p-lp151.5.20.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.2 | npm12 | * | Up to (excluding) 1.0.2p-lp152.8.9.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | opensuse_Leap_15.4 | libexiv2-26-32bit | * | Up to (excluding) 26-0.26-150400.9.16.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_6 | oraclelinux-release | * | Up to (excluding) 1.0.1e-59.0.1.el6_10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_7 | oraclelinux-release | * | Up to (excluding) 1.0.2k-21.el7_9 | |||||
| 运行在以下环境 | |||||||||
| 系统 | oracle_8 | oraclelinux-release | * | Up to (excluding) 1.1.1g-12.el8_3 | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_6 | openssl | * | Up to (excluding) 0:1.0.1e-59.el6_10 | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_7 | openssl | * | Up to (excluding) 1.0.2k-21.el7_9 | |||||
| 运行在以下环境 | |||||||||
| 系统 | redhat_8 | openssl-devel | * | Up to (excluding) 1.1.1g-12.el8_3 | |||||
| 运行在以下环境 | |||||||||
| 系统 | suse_12_SP5 | libopenssl1_1 | * | Up to (excluding) 1.0.2p-3.30.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_16.04 | openssl | * | Up to (excluding) 1.0.2g-1ubuntu4.18 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_16.04.7_lts | openssl | * | Up to (excluding) 1.0.2g-1ubuntu4.18 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04 | openssl | * | Up to (excluding) 1.0.2n-1ubuntu5.5 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_18.04.5_lts | openssl | * | Up to (excluding) 1.1.1-1ubuntu2.1~18.04.7 | |||||
| 运行在以下环境 | |||||||||
| 系统 | ubuntu_20.04 | openssl | * | Up to (excluding) 1.1.1f-1ubuntu2.1 | |||||
| 运行在以下环境 | |||||||||
| 系统 | unionos_a | openssl | * | Up to (excluding) openssl-1.1.1c-17.uelc20.5 | |||||
| 运行在以下环境 | |||||||||
| 系统 | unionos_e | shim | * | Up to (excluding) shim-15-24.up5.uel20 | |||||
- 攻击路径 远程
- 攻击复杂度 困难
- 权限要求 无需权限
- 影响范围 有限影响
- EXP成熟度 POC 已公开
- 补丁情况 官方补丁
- 数据保密性 无影响
- 数据完整性 无影响
- 服务器危害 无影响
- 全网数量 100
| CWE-ID | 漏洞类型 |
| CWE-476 | 空指针解引用 |
Exp相关链接
- avd.aliyun.com
版权声明
本站原创文章转载请注明文章出处及链接，谢谢合作！
评论