yaws: CVE-2020-12872

Debian Bug report logs - #961422
yaws: CVE-2020-12872

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: yaws: CVE-2020-12872

Date: Sun, 24 May 2020 15:06:41 +0200

Source: yaws
Version: 2.0.7+dfsg-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/erlyaws/yaws/issues/402
Control: found -1 2.0.6+dfsg-1
Control: found -1 2.0.4+dfsg-1

Hi,

The following vulnerability was published for yaws.

CVE-2020-12872[0]:
| yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS
| ciphers, as demonstrated by ones that allow Sweet32 attacks.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2020-12872
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12872
[1] https://github.com/erlyaws/yaws/issues/402

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #14 received at 961422@bugs.debian.org (full text, mbox, reply):

From: Sergei Golovan <sgolovan@gmail.com>

To: Salvatore Bonaccorso <carnil@debian.org>, 961422@bugs.debian.org

Subject: Re: [Pkg-erlang-devel] Bug#961422: yaws: CVE-2020-12872

Date: Sun, 24 May 2020 20:05:23 +0300

Hi Salvatore,

On Sun, May 24, 2020 at 4:09 PM Salvatore Bonaccorso <carnil@debian.org> wrote:
>
> The following vulnerability was published for yaws.
>
> CVE-2020-12872[0]:
> | yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS
> | ciphers, as demonstrated by ones that allow Sweet32 attacks.
>

As far as I can see, YAWS just uses the ciphersuite offered by the Erlang ssl
application. It indeed includes 3DES based ciphers in Erlang 19.2.1 (in stretch)
and in Erlang 17.3 (in jessie), but doesn't do so in Erlang 21.2.6 (in
buster) and
in later versions (in bullseye, sid and experimental).

So, currently, YAWS is vulnerable for jessie and stretch only.

>
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

I would rather suggest to reassign this bug to erlang-ssl, and fix it there
(as not only YAWS can use this list of ciphers).

I've already prepared a patch for erlang in stretch, and if you think
it's an acceptable way
of fixing this bug, I'll inform the release team about it.

I wouldn't like to do anything about jessie, since its LTS support
comes to an end soon.

Sheers!
-- 
Sergei Golovan

Send a report that this bug log contains spam.