CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2017-1000385 – erlang: TLS server vulnerable to Adaptive Chosen Ciphertext attack allowing plaintext recovery or MITM attack
https://notcve.org/view.php?id=CVE-2017-1000385
The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack). El servidor TLS en Erlang/OTP responde con alertas TLS diferentes a los diferentes tipos de error en el relleno RSA PKCS #1 1.5. Esto permite que un atacante descifre contenido o firme mensajes con la clave privada del servidor (esta es una variación del ataque Bleichenbacher). An erlang TLS server configured with cipher suites using RSA key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) against RSA. • http://erlang.org/pipermail/erlang-questions/2017-November/094255.html http://erlang.org/pipermail/erlang-questions/2017-November/094256.html http://erlang.org/pipermail/erlang-questions/2017-November/094257.html http://www.securityfocus.com/bid/102197 https://access.redhat.com/errata/RHSA-2018:0242 https://access.redhat.com/errata/RHSA-2018:0303 https://access.redhat.com/errata/RHSA-2018:0368 https://access.redhat.com/errata/RHSA-2018:0528 https://lists.debian.org/debian-lts-announce&# • CWE-203: Observable Discrepancy CWE-300: Channel Accessible by Non-Endpoint •
CVSS: 9.8EPSS: 0%CPEs: 67EXPL: 0CVE-2016-10253
https://notcve.org/view.php?id=CVE-2016-10253
An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to. Se ha descubierto un problema en Erlang/OTP 18.x. • https://github.com/erlang/otp/pull/1108 https://usn.ubuntu.com/3571-1 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •