CVE-2020-1971

CVE-2020-1971 is a NULL pointer dereference vulnerability in OpenSSL versions 1.1.1 and 1.0.2, specifically within the GENERAL_NAME_cmp function when processing malformed X.509 EDIPARTYNAMEs. This flaw can lead to a denial of service (DoS) attack if an attacker can trick a client or server into comparing a malicious certificate against a malicious Certificate Revocation List (CRL). The vulnerability has a CVSS score of 5.9 (Medium), indicating a network-based attack with high impact on availability and high attack complexity, as it requires controlling both items being compared. While there is no evidence of active exploitation or publicly available exploit code, the vulnerability has garnered significant community discussion and media coverage, with DHS-CISA urging administrators to patch.