Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade erlang | Jul 30, 2024 | Apr 7, 2016 |
| Oracle Solaris | — | Upgrade runtime/erlang to version 19.3-0.175.3.23.0.1.0 on Solaris 11.3Upgrade runtime/erlang/documentation to version 19.3-0.175.3.23.0.1.0 on Solaris 11.3Upgrade runtime/erlang to version 17.5-0.175.2.11.0.2.0 on Solaris 11.2Upgrade runtime/erlang/documentation to version 17.5-0.175.2.11.0.2.0 on Solaris 11.2 | May 29, 2017 | Apr 7, 2016 |
| Suse | — | Upgrade erlang-jinterface-srcUpgrade erlang-reltool-srcUpgrade erlang-dialyzer-srcUpgrade erlang-epmdUpgrade erlang-epmd-debuginfoUpgrade erlang-debugger-srcUpgrade erlang-docUpgrade erlangUpgrade erlang-jinterfaceUpgrade erlang-observerUpgrade erlang-debuginfoUpgrade erlang-wx-srcUpgrade erlang-gs-srcUpgrade erlang-srcUpgrade erlang-etUpgrade erlang-dialyzer-debuginfoUpgrade erlang-wx-debuginfoUpgrade erlang-et-srcUpgrade erlang-gsUpgrade erlang-reltoolUpgrade erlang-debuggerUpgrade erlang-debugsourceUpgrade erlang-dialyzerUpgrade erlang-observer-srcUpgrade erlang-wx | Apr 7, 2016 | Feb 20, 2016 |
| Ubuntu | — | Upgrade erlang | Feb 15, 2018 | Apr 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub