Lucene search

K

Erlang Security Vulnerabilities

cve
cve

CVE-2009-0130

lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value from the OpenSSL DSA_do_verify function, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a package...

7.6AI Score

0.007EPSS

2022-10-03 04:24 PM
30
cve
cve

CVE-2023-48795

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a...

5.9CVSS

6.7AI Score

0.962EPSS

2023-12-18 04:15 PM
401
cve
cve

CVE-2020-35733

An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certification...

7.5CVSS

7.2AI Score

0.001EPSS

2021-01-15 02:15 PM
73
7
cve
cve

CVE-2011-0766

The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which makes it easier for remote attackers to guess DSA host and SSH session...

6.4AI Score

0.002EPSS

2022-10-03 04:15 PM
76
cve
cve

CVE-2022-37026

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and...

9.8CVSS

9.2AI Score

0.002EPSS

2022-09-21 02:15 PM
112
4
cve
cve

CVE-2015-2774

Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka...

5.9CVSS

4.6AI Score

0.975EPSS

2016-04-07 09:59 PM
52
cve
cve

CVE-2014-2829

Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb"...

6.8AI Score

0.003EPSS

2022-10-03 04:20 PM
28
cve
cve

CVE-2021-29221

A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. By adding files to an existing installation's directory, a local attacker could hijack accounts of other users running Erlang programs or possibly coerce a service running with "erlsrv.exe" to execute.....

7CVSS

7.5AI Score

0.001EPSS

2021-04-09 02:15 PM
33
cve
cve

CVE-2020-25623

Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal. An attacker can send a crafted HTTP request to read arbitrary files, if httpd in the inets application is...

7.5CVSS

7.3AI Score

0.003EPSS

2020-10-02 12:15 PM
38
cve
cve

CVE-2020-13802

Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency...

9.8CVSS

9.6AI Score

0.476EPSS

2020-09-02 05:15 PM
27
cve
cve

CVE-2016-1000107

inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an...

6.1CVSS

6.3AI Score

0.002EPSS

2019-12-10 06:15 PM
35
cve
cve

CVE-2019-1000014

Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised...

8.8CVSS

8.8AI Score

0.003EPSS

2019-02-04 09:29 PM
22
cve
cve

CVE-2017-1000385

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher...

5.9CVSS

5.6AI Score

0.003EPSS

2017-12-12 09:29 PM
147
cve
cve

CVE-2016-10253

An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the...

9.8CVSS

9.1AI Score

0.002EPSS

2017-03-18 08:59 PM
43
cve
cve

CVE-2014-1693

Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12)....

9.7AI Score

0.016EPSS

2014-12-08 11:59 AM
34