yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP virtual machine with a version less than 21.0.
References
| Link | Resource |
|---|---|
| https://github.com/erlyaws/yaws/blob/c0fd79f17d52628fcec527da7fa3e788c283c445/src/yaws_config.erl#L2068-L2075 | Exploit Third Party Advisory |
| https://github.com/erlyaws/yaws/issues/402 | Issue Tracking Third Party Advisory |
| https://github.com/erlyaws/yaws/releases | Release Notes Third Party Advisory |
| https://medium.com/%40charlielabs101/cve-2020-12872-df315411aa70 | |
| https://sweet32.info/ | Third Party Advisory |
| https://github.com/erlyaws/yaws/blob/c0fd79f17d52628fcec527da7fa3e788c283c445/src/yaws_config.erl#L2068-L2075 | Exploit Third Party Advisory |
| https://github.com/erlyaws/yaws/issues/402 | Issue Tracking Third Party Advisory |
| https://github.com/erlyaws/yaws/releases | Release Notes Third Party Advisory |
| https://medium.com/%40charlielabs101/cve-2020-12872-df315411aa70 | |
| https://sweet32.info/ | Third Party Advisory |
Configurations
History
21 Nov 2024, 05:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/erlyaws/yaws/blob/c0fd79f17d52628fcec527da7fa3e788c283c445/src/yaws_config.erl#L2068-L2075 - Exploit, Third Party Advisory | |
| References | () https://github.com/erlyaws/yaws/issues/402 - Issue Tracking, Third Party Advisory | |
| References | () https://github.com/erlyaws/yaws/releases - Release Notes, Third Party Advisory | |
| References | () https://medium.com/%40charlielabs101/cve-2020-12872-df315411aa70 - | |
| References | () https://sweet32.info/ - Third Party Advisory |
Information
Published : 2020-05-15 19:15
Updated : 2024-11-21 05:00
NVD link : CVE-2020-12872
Mitre link : CVE-2020-12872
CVE.ORG link : CVE-2020-12872
JSON object : View
Products Affected
yaws
- yaws
CWE
CWE-326
Inadequate Encryption Strength