Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade erlang | Jul 30, 2024 | Apr 7, 2016 |
| Oracle Solaris | — | Upgrade runtime/erlang/documentation to version 19.3-0.175.3.23.0.1.0 on Solaris 11.3Upgrade runtime/erlang to version 17.5-0.175.2.11.0.2.0 on Solaris 11.2Upgrade runtime/erlang/documentation to version 17.5-0.175.2.11.0.2.0 on Solaris 11.2Upgrade runtime/erlang to version 19.3-0.175.3.23.0.1.0 on Solaris 11.3 | May 29, 2017 | Apr 7, 2016 |
| Suse | — | Upgrade erlang-dialyzerUpgrade erlang-gsUpgrade erlang-wxUpgrade erlang-debuggerUpgrade erlang-observer-srcUpgrade erlang-reltoolUpgrade erlang-et-srcUpgrade erlang-debugsourceUpgrade erlang-epmdUpgrade erlang-observerUpgrade erlang-dialyzer-debuginfoUpgrade erlang-wx-srcUpgrade erlang-srcUpgrade erlang-debuginfoUpgrade erlang-epmd-debuginfoUpgrade erlang-jinterfaceUpgrade erlang-gs-srcUpgrade erlang-etUpgrade erlang-dialyzer-srcUpgrade erlang-jinterface-srcUpgrade erlang-wx-debuginfoUpgrade erlang-debugger-srcUpgrade erlang-docUpgrade erlang-reltool-srcUpgrade erlang | Apr 7, 2016 | Feb 20, 2016 |
| Ubuntu | — | Upgrade erlang | Feb 15, 2018 | Apr 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub