In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade erlangUpgrade erlang26 | Aug 22, 2024 | Sep 21, 2022 |
| Debian | — | Upgrade erlang | Jul 17, 2023 | Sep 21, 2022 |
| Suse | — | Upgrade erlang-debugger-srcUpgrade erlang-wxUpgrade erlang-reltoolUpgrade erlang-observer-srcUpgrade erlang-reltool-srcUpgrade erlang-wx-srcUpgrade erlangUpgrade erlang-observerUpgrade erlang-docUpgrade erlang-srcUpgrade erlang-epmdUpgrade erlang-jinterfaceUpgrade erlang-dialyzer-srcUpgrade erlang-diameterUpgrade erlang-et-srcUpgrade erlang-jinterface-srcUpgrade erlang-debuggerUpgrade erlang-diameter-srcUpgrade erlang-dialyzerUpgrade erlang-et | Nov 25, 2022 | Sep 21, 2022 |
| Ubuntu | — | Upgrade erlangUpgrade erlang-ssl | May 9, 2023 | Sep 21, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub