[SECURITY] [DLA 3491-1] erlang security update

Debian LTS Advisory DLA-3491-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany July 11, 2023 https://wiki.debian.org/LTS Package : erlang Version : 1:22.2.7+dfsg-1+deb10u1 CVE ID : CVE-2022-37026 Debian Bug : 1024632 A Client Authentication Bypass vulnerability ha...

DLA-3491-1 erlang - security update

Bulletin has no description...

Debian dla-3491 : erlang - security update

The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3491 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3491-1 [email protected] https://www.debian.org/lts/security/...

Ubuntu: Security Advisory (USN-6059-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6059-1 erlang vulnerability

It was discovered that Erlang did not properly implement TLS client certificate validation during the TLS handshake. A remote attacker could use this issue to bypass client authentication...

USN-6059-1: Erlang vulnerability

It was discovered that Erlang did not properly implement TLS client certificate validation during the TLS handshake. A remote attacker could use this issue to bypass client authentication...

Ubuntu 20.04 LTS / 22.04 LTS : Erlang vulnerability (USN-6059-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-6059-1 advisory. It was discovered that Erlang did not properly implement TLS client certificate validation during the TLS handshake. A remote attacker could use this...

CVE-2018-25032 affecting package erlang 24.2-1

CVE-2018-25032 affecting package erlang 24.2-1. A patched version of the package is available...

The vulnerability of the Erlang programming language, related to errors in the certificate validation process, allows attackers to access confidential data.

The vulnerability of the Erlang programming language is related to errors in the certificate validation process. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to confidential data...

The vulnerability of the Erlang programming language lies in its lack of name restriction for path entries in the directory structure, which allows attackers to access confidential data.

The vulnerability of the Erlang programming language is related to deficiencies in pathname limitation for directories. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data...

Debian: Security Advisory (DLA-1207-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

K42944216: Erlang vulnerability CVE-2017-1000385

Security Advisory Description The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS 1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key this is a variation of the Bleichenbacher attack...

SUSE CVE-2014-1693

Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the 1 user, 2 account, 3 cd, 4 ls, 5 nlist, 6 rename, 7 delete, 8 mkdir, 9 rmdir, 10 recv, 11 recvbin, 12 recvchunkstart, 13 send...

SUSE CVE-2014-9568

puppetlabs-rabbitmq 3.0 through 4.1 stores the RabbitMQ Erlang cookie value in the facts of a node, which allows local users to obtain sensitive information as demonstrated by using Facter...

SUSE CVE-2015-2774

Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 aka POODLE...

SUSE CVE-2016-10253

An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the...

SUSE CVE-2016-1000107

inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTPPROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an...

SUSE CVE-2017-1000385

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS 1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key this is a variation of the Bleichenbacher attack...

SUSE CVE-2019-11287

Pivotal RabbitMQ, versions 3.7.x prior to 3.7.21 and 3.8.x prior to 3.8.1, and RabbitMQ for Pivotal Platform, 1.16.x versions prior to 1.16.7 and 1.17.x versions prior to 1.17.4, contain a web management plugin that is vulnerable to a denial of service attack. The "X-Reason" HTTP Header can be...

SUSE CVE-2020-25623

Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal. An attacker can send a crafted HTTP request to read arbitrary files, if httpd in the inets application is used...