4.3
CVSSv2

CVE-2017-1000385

Published: 12/12/2017 Updated: 03/10/2019
CVSS v2 Base Score: 4.3 | Impact Score: 2.9 | Exploitability Score: 8.6
CVSS v3 Base Score: 5.9 | Impact Score: 3.6 | Exploitability Score: 2.2
VMScore: 470
Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Vulnerability Summary

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an malicious user to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack).

Vulnerable Product Search on Vulmon Subscribe to Product

erlang erlang\\/otp 18.3.4.7

erlang erlang\\/otp 19.3.6.4

erlang erlang\\/otp 20.1.7

debian debian linux 9.0

debian debian linux 8.0

Vendor Advisories

Several security issues were fixed in Erlang ...
Synopsis Low: erlang security and bug fix update Type/Severity Security Advisory: Low Topic An update for erlang is now available for Red Hat OpenStack Platform 110 (Ocata)Red Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) base s ...
Synopsis Low: erlang security update Type/Severity Security Advisory: Low Topic An update for erlang is now available for Red Hat OpenStack Platform 120 (Pike)Red Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) base score, which g ...
Synopsis Low: erlang security update Type/Severity Security Advisory: Low Topic An update for erlang is now available for Red Hat OpenStack Platform 90 (Mitaka)Red Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) base score, which ...
Synopsis Low: erlang security update Type/Severity Security Advisory: Low Topic An update for erlang is now available for Red Hat OpenStack Platform 100 (Newton)Red Hat Product Security has rated this update as having a security impact of Low A Common Vulnerability Scoring System (CVSS) base score, which ...
An erlang TLS server configured with cipher suites using RSA key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) against RSA This may result in plain-text recovery of encrypted messages and/or a man-in-the-middle (MiTM) attack, despite the attacker not having gained access to the server’s private k ...