CVSS: 5.9EPSS: 0%CPEs: 3EXPL: 0CVE-2015-2774
https://notcve.org/view.php?id=CVE-2015-2774
Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE). Erlang/OTP en versiones anteriores a 18.0-rc1 no comprueba correctamente los bytes de relleno CBC cuando finaliza las conexiones, lo que hace más fácil para atacantes man-in-the-middle obtener datos en texto plano a través de un ataque padding-oracle, una variante de CVE-2014-3566 (también conocida como POODLE). • http://lists.opensuse.org/opensuse-updates/2016-02/msg00124.html http://openwall.com/lists/oss-security/2015/03/27/6 http://openwall.com/lists/oss-security/2015/03/27/9 http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html http://www.securityfocus.com/bid/73398 https://usn.ubuntu.com/3571-1 https://web.archive.org/web/20150905124006/http://www.erlang.org/news/85 https://www.imperialviolet.org/2014/12/08/poodleagain.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 1%CPEs: 1EXPL: 1CVE-2014-1693
https://notcve.org/view.php?id=CVE-2014-1693
Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, or (18) append_bin command. Múltiples vulnerabilidades de inyección CRLF en el módulo FTP en Erlang/OTP R15B03 permiten a atacantes dependientes de contexto inyectar comandos FTP arbitrarios a través de secuencias CRLF en el comando (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, o (18) append_bin. • http://advisories.mageia.org/MGASA-2014-0553.html http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145017.html http://seclists.org/oss-sec/2014/q1/163 http://www.mandriva.com/security/advisories?name=MDVSA-2015:174 https://bugzilla.redhat.com/show_bug.cgi?id=1059331 https://usn.ubuntu.com/3571-1 •
CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 1CVE-2014-2829
https://notcve.org/view.php?id=CVE-2014-2829
Erlang Solutions MongooseIM through 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, which allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, aka an "xmppbomb" attack. Erlang Solutions MongooseIM hasta 1.3.1 rev. 2 no restringe debidamente el procesamiento de elementos XML comprimidos, lo que permite a atacantes remotos causar una denegación de servicio (consumo de recursos) a través de una cadena XMPP manipulada, también conocido como un ataque "xmppbomb". • http://xmpp.org/resources/security-notices/uncontrolled-resource-consumption-with-highly-compressed-xmpp-stanzas https://github.com/esl/MongooseIM/commit/586d96cc12ef218243a3466354b4d208b5472a6c • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 0CVE-2011-0766
https://notcve.org/view.php?id=CVE-2011-0766
The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which makes it easier for remote attackers to guess DSA host and SSH session keys. El generador de números aleatorios de la aplicación Crypto en versiones anteriores a la 2.0.2.2, y SSH anteriores a 2.0.5, como es usado en la librería Erlang/OTP ssh en versiones anteriores a la R14B03, utiliza semillas predecibles basadas en la fecha actual, lo que facilita a atacantes remotos adivinar el host DSA y las claves de sesión SSH. • http://secunia.com/advisories/44709 http://www.kb.cert.org/vuls/id/178990 http://www.securityfocus.com/bid/47980 https://github.com/erlang/otp/commit/f228601de45c5b53241b103af6616453c50885a5 • CWE-310: Cryptographic Issues •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2009-0130
https://notcve.org/view.php?id=CVE-2009-0130
lib/crypto/c_src/crypto_drv.c in erlang does not properly check the return value from the OpenSSL DSA_do_verify function, which might allow remote attackers to bypass validation of the certificate chain via a malformed SSL/TLS signature, a similar vulnerability to CVE-2008-5077. NOTE: a package maintainer disputes this issue, reporting that there is a proper check within the only code that uses the applicable part of crypto_drv.c, and thus "this report is invalid. ** CUESTIONADA ** lib/crypto/c_src/crypto_drv.c en erlang no comprueba adecuadamente el retorno del valor de la función OpenSSL DSA_do_verify, esto permitiría a atacantes remotos eludir la validación de la cadena de certificados a través de una firma SSL/TLS, una vulnerabilidad similar a CVE-2008-5077. NOTA: Un desarrollador del paquete cuestiona los hechos, reportando que existe una comprobación adecuada dentro del unico codigo que utiliza la parte aplicable de crypto_drv.c, por lo que "este informe es invalido". • http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=511520 http://openwall.com/lists/oss-security/2009/01/12/4 • CWE-287: Improper Authentication •