In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade erlang26Upgrade erlang | Aug 22, 2024 | Sep 21, 2022 |
| Debian | — | Upgrade erlang | Jul 17, 2023 | Sep 21, 2022 |
| Suse | — | Upgrade erlang-diameterUpgrade erlang-epmdUpgrade erlang-srcUpgrade erlang-et-srcUpgrade erlang-jinterfaceUpgrade erlang-dialyzer-srcUpgrade erlang-diameter-srcUpgrade erlang-docUpgrade erlang-etUpgrade erlang-observerUpgrade erlang-debuggerUpgrade erlang-dialyzerUpgrade erlang-jinterface-srcUpgrade erlang-wxUpgrade erlang-observer-srcUpgrade erlang-reltoolUpgrade erlangUpgrade erlang-wx-srcUpgrade erlang-reltool-srcUpgrade erlang-debugger-src | Nov 25, 2022 | Sep 21, 2022 |
| Ubuntu | — | Upgrade erlang-sslUpgrade erlang | May 9, 2023 | Sep 21, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub