Published: 15/05/2020 Updated: 07/11/2023

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

CVSS v3 Base Score: 5.5 | Impact Score: 3.6 | Exploitability Score: 1.8

VMScore: 187

Vector: AV:L/AC:L/Au:N/C:P/I:N/A:N

yaws_config.erl in Yaws up to and including 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP virtual machine with a version less than 21.0.

Vulnerable Product	Search on Vulmon	Subscribe to Product
yaws yaws

Debian Bug report logs - #961422 yaws: CVE-2020-12872 Package: src:yaws; Maintainer for src:yaws is Debian Erlang Packagers <pkg-erlang-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sun, 24 May 2020 13:09:01 UTC Severity: important Tags: security, upstream Found in versi ...

yaws_configerl in Yaws through 207 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks ...

CWE-326 https://github.com/erlyaws/yaws/releases https://sweet32.info/https://github.com/erlyaws/yaws/blob/c0fd79f17d52628fcec527da7fa3e788c283c445/src/yaws_config.erl#L2068-L2075 https://github.com/erlyaws/yaws/issues/402 https://medium.com/%40charlielabs101/cve-2020-12872-df315411aa70 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=961422 https://nvd.nist.gov https://security.archlinux.org/CVE-2020-12872

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2020-12872

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect