CVE-2017-1000385

Description

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the servers private key (this is a variation of the Bleichenbacher attack).

Risk Information

Base Score

5.9

MODERATE

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score

Exploitation Probability

83.282

Associated Vulnerability

Vulnerability	OS Platform
Concurrent, real-time, distributed functional language (USN-3571-1) erlang_18.3-dfsg-1ubuntu3.1_all.deb	Linux
Concurrent, real-time, distributed functional language (USN-3571-1) erlang_16.b.3-dfsg-1ubuntu2.2_all.deb	Linux
Concurrent, real-time, distributed functional language (USN-3571-1) erlang_20.0.4+dfsg-1ubuntu1.1_all.deb	Linux
erlang security update(DSA-4057-1) erlang_19.2.1+dfsg-2+deb9u1_all.deb	Linux
Observable Discrepancy Vulnerability (CVE-2017-1000385)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234