In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade erlangUpgrade erlang26 | Aug 22, 2024 | Sep 21, 2022 |
| Debian | — | Upgrade erlang | Jul 17, 2023 | Sep 21, 2022 |
| Suse | — | Upgrade erlangUpgrade erlang-observer-srcUpgrade erlang-wxUpgrade erlang-reltool-srcUpgrade erlang-debugger-srcUpgrade erlang-wx-srcUpgrade erlang-reltoolUpgrade erlang-epmdUpgrade erlang-et-srcUpgrade erlang-jinterface-srcUpgrade erlang-diameterUpgrade erlang-srcUpgrade erlang-dialyzer-srcUpgrade erlang-debuggerUpgrade erlang-diameter-srcUpgrade erlang-dialyzerUpgrade erlang-etUpgrade erlang-observerUpgrade erlang-docUpgrade erlang-jinterface | Nov 25, 2022 | Sep 21, 2022 |
| Ubuntu | — | Upgrade erlangUpgrade erlang-ssl | May 9, 2023 | Sep 21, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub