CVE-2015-2774

Description

Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).

Risk Information

Base Score

5.9

MODERATE

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

0.529

Associated Vulnerability

Vulnerability	OS Platform
Concurrent, real-time, distributed functional language (USN-3571-1) erlang_18.3-dfsg-1ubuntu3.1_all.deb	Linux
Concurrent, real-time, distributed functional language (USN-3571-1) erlang_16.b.3-dfsg-1ubuntu2.2_all.deb	Linux
Concurrent, real-time, distributed functional language (USN-3571-1) erlang_20.0.4+dfsg-1ubuntu1.1_all.deb	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234