erlang: TLS server vulnerable to Adaptive Chosen Ciphertext attack allowing plaintext recovery or MITM attack

An erlang TLS server configured with cipher suites using RSA key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack against RSA. This may result in plain-text recovery of encrypted messages and/or a man-in-the-middle MiTM attack, despite the attacker not...

The vulnerability of the CouchDB database management system stems from differences in how JSON parsers based on Erlang and JavaScript operate. This allows a hacker to execute arbitrary shell commands on the server with administrator privileges.

The vulnerability of the CouchDB database management system is related to differences in how JSON-based parsers running on Erlang and JavaScript operate. Exploiting this vulnerability allows a remote attacker, who is not an administrator of the system, to gain access to execute arbitrary shell...

Fedora 27 : couchdb / erlang-jiffy (2017-a20d92573b)

CouchDB ver. 1.7.1 - Fixed CVE-2017-12635 - Fixed CVE-2017-12636 - Switched to eunit for testing - Erlang 20 compatible Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and...

Fedora 27 : erlang (2017-9e6df1e099) (ROBOT)

Ver. 19.3.6.4 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

MGASA-2018-0060 Updated erlang packages fix security vulnerabilities

It was discovered that the TLS server in Erlang is vulnerable to an adaptive chosen ciphertext attack against RSA keys CVE-2017-1000385...

Updated erlang packages fix security vulnerabilities

It was discovered that the TLS server in Erlang is vulnerable to an adaptive chosen ciphertext attack against RSA keys CVE-2017-1000385...

Apache CouchDB JSON Remote Privilege Escalation (CVE-2017-12635)

A privilege escalation vulnerability exists in CouchDB. The vulnerability is due to a discrepancy between the behaviour of the Erlang and JavaScript JSON parsers used within CouchDB. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted HTTP request to a...

Debian DLA-1207-1 : erlang security update (ROBOT)

An erlang TLS server configured with cipher suites using RSA key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack against RSA, which when exploited, may result in plaintext recovery of encrypted messages and/or a Man-in-the-middle MiTM attack, despite...

[SECURITY] [DLA 1207-1] erlang security update

Package : erlang Version : 15.b.1-dfsg-4+deb7u2 CVE ID : CVE-2017-1000385 An erlang TLS server configured with cipher suites using RSA key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack AKA Bleichenbacher attack against RSA, which when exploited, may result in plaintext...

Ericsson Erlang otp TLS server information disclosure vulnerability

Ericsson Erlang otp TLS server is a TLS Secure Transport Protocol server written in the Erlang language, developed and maintained by Ericsson, Sweden. A security vulnerability exists in the Ericsson Erlang otp TLS server, which originates from the program responding to different alerts for...

DLA-1207-1 erlang - security update

Bulletin has no description...

Fedora Update for erlang FEDORA-2017-93b6236635

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for erlang FEDORA-2017-9e6df1e099

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Update : erlang (openSUSE-2017-1358) (ROBOT)

This update for erlang fixes security issues and bugs. The following vulnerabilities were addressed : - CVE-2017-1000385: Harden against the Bleichenbacher attacher against RSA - CVE-2016-10253: Heap overflow through regular expressions bsc1030062 In addition Erlang was updated to version 18.3.4....

Fedora 26 : erlang (2017-93b6236635) (ROBOT)

Ver. 19.3.6.4 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...

Code injection

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS 1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key this is a variation of the Bleichenbacher attack...

DEBIAN-CVE-2017-1000385

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS 1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key this is a variation of the Bleichenbacher attack...

CVE-2017-1000385

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS 1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key this is a variation of the Bleichenbacher attack...

CVE-2017-1000385

CVE-2017-1000385 affects the Erlang OTP TLS server, where RSA PKCS#1 v1.5 padding errors elicit different TLS alerts, enabling a Bleichenbacher-style oracle to decrypt content or forge signatures with the server’s private key. Public disclosures describe a CERT/ROBOT-related risk and list affecte...

CVE-2017-1000385

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS 1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key this is a variation of the Bleichenbacher attack...