CVE-2017-1000385

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack).
References
Link Resource
http://erlang.org/pipermail/erlang-questions/2017-November/094255.html Issue Tracking Mailing List Vendor Advisory
http://erlang.org/pipermail/erlang-questions/2017-November/094256.html Issue Tracking Mailing List Vendor Advisory
http://erlang.org/pipermail/erlang-questions/2017-November/094257.html Issue Tracking Mailing List Vendor Advisory
http://www.securityfocus.com/bid/102197 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:0242
https://access.redhat.com/errata/RHSA-2018:0303
https://access.redhat.com/errata/RHSA-2018:0368
https://access.redhat.com/errata/RHSA-2018:0528
https://lists.debian.org/debian-lts-announce/2017/12/msg00010.html
https://robotattack.org/ Issue Tracking Third Party Advisory
https://usn.ubuntu.com/3571-1/
https://www.debian.org/security/2017/dsa-4057 Issue Tracking Third Party Advisory
https://www.kb.cert.org/vuls/id/144389 Issue Tracking Third Party Advisory US Government Resource
http://erlang.org/pipermail/erlang-questions/2017-November/094255.html Issue Tracking Mailing List Vendor Advisory
http://erlang.org/pipermail/erlang-questions/2017-November/094256.html Issue Tracking Mailing List Vendor Advisory
http://erlang.org/pipermail/erlang-questions/2017-November/094257.html Issue Tracking Mailing List Vendor Advisory
http://www.securityfocus.com/bid/102197 Third Party Advisory VDB Entry
https://access.redhat.com/errata/RHSA-2018:0242
https://access.redhat.com/errata/RHSA-2018:0303
https://access.redhat.com/errata/RHSA-2018:0368
https://access.redhat.com/errata/RHSA-2018:0528
https://lists.debian.org/debian-lts-announce/2017/12/msg00010.html
https://robotattack.org/ Issue Tracking Third Party Advisory
https://usn.ubuntu.com/3571-1/
https://www.debian.org/security/2017/dsa-4057 Issue Tracking Third Party Advisory
https://www.kb.cert.org/vuls/id/144389 Issue Tracking Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:erlang:erlang\/otp:18.3.4.7:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:19.3.6.4:*:*:*:*:*:*:*
cpe:2.3:a:erlang:erlang\/otp:20.1.7:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

History

21 Nov 2024, 03:04

Type Values Removed Values Added
References () http://erlang.org/pipermail/erlang-questions/2017-November/094255.html - Issue Tracking, Mailing List, Vendor Advisory () http://erlang.org/pipermail/erlang-questions/2017-November/094255.html - Issue Tracking, Mailing List, Vendor Advisory
References () http://erlang.org/pipermail/erlang-questions/2017-November/094256.html - Issue Tracking, Mailing List, Vendor Advisory () http://erlang.org/pipermail/erlang-questions/2017-November/094256.html - Issue Tracking, Mailing List, Vendor Advisory
References () http://erlang.org/pipermail/erlang-questions/2017-November/094257.html - Issue Tracking, Mailing List, Vendor Advisory () http://erlang.org/pipermail/erlang-questions/2017-November/094257.html - Issue Tracking, Mailing List, Vendor Advisory
References () http://www.securityfocus.com/bid/102197 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/102197 - Third Party Advisory, VDB Entry
References () https://access.redhat.com/errata/RHSA-2018:0242 - () https://access.redhat.com/errata/RHSA-2018:0242 -
References () https://access.redhat.com/errata/RHSA-2018:0303 - () https://access.redhat.com/errata/RHSA-2018:0303 -
References () https://access.redhat.com/errata/RHSA-2018:0368 - () https://access.redhat.com/errata/RHSA-2018:0368 -
References () https://access.redhat.com/errata/RHSA-2018:0528 - () https://access.redhat.com/errata/RHSA-2018:0528 -
References () https://lists.debian.org/debian-lts-announce/2017/12/msg00010.html - () https://lists.debian.org/debian-lts-announce/2017/12/msg00010.html -
References () https://robotattack.org/ - Issue Tracking, Third Party Advisory () https://robotattack.org/ - Issue Tracking, Third Party Advisory
References () https://usn.ubuntu.com/3571-1/ - () https://usn.ubuntu.com/3571-1/ -
References () https://www.debian.org/security/2017/dsa-4057 - Issue Tracking, Third Party Advisory () https://www.debian.org/security/2017/dsa-4057 - Issue Tracking, Third Party Advisory
References () https://www.kb.cert.org/vuls/id/144389 - Issue Tracking, Third Party Advisory, US Government Resource () https://www.kb.cert.org/vuls/id/144389 - Issue Tracking, Third Party Advisory, US Government Resource

Information

Published : 2017-12-12 21:29

Updated : 2024-11-21 03:04


NVD link : CVE-2017-1000385

Mitre link : CVE-2017-1000385

CVE.ORG link : CVE-2017-1000385


JSON object : View

Products Affected

erlang

  • erlang\/otp

debian

  • debian_linux
CWE
CWE-203

Observable Discrepancy