K42944216 : Erlang vulnerability CVE-2017-1000385

2017-12-2700:00:00

my.f5.com

5.7 Medium

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.4%

JSON

Security Advisory Description

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server’s private key (this is a variation of the Bleichenbacher attack). (CVE-2017-1000385)

Impact

There is no impact; F5 products are not affected by this vulnerability.

CPENameOperatorVersion
big-ip afmeq11.5.1
big-ip afmeq11.5.2
big-ip afmeq11.5.3
big-ip afmeq11.5.4
big-ip afmeq11.5.5
big-ip afmeq11.6.1
big-ip afmeq11.6.2
big-ip afmeq12.0.0
big-ip afmeq12.1.0
big-ip afmeq12.1.1

Name	Operator	Version
big-ip afm	eq	11.5.1
big-ip afm	eq	11.5.2
big-ip afm	eq	11.5.3
big-ip afm	eq	11.5.4
big-ip afm	eq	11.5.5
big-ip afm	eq	11.6.1
big-ip afm	eq	11.6.2
big-ip afm	eq	12.0.0
big-ip afm	eq	12.1.0
big-ip afm	eq	12.1.1