Vulnerability Details CVE-2015-2774
Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
Exploit prediction scoring system (EPSS) score
EPSS Score 0.008
EPSS Ranking 72.8%
CVSS Severity
CVSS v3 Score 5.9
CVSS v2 Score 4.3
References
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00124.html
- http://openwall.com/lists/oss-security/2015/03/27/6
- http://openwall.com/lists/oss-security/2015/03/27/9
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.securityfocus.com/bid/73398
- https://usn.ubuntu.com/3571-1/
- https://web.archive.org/web/20150905124006/http://www.erlang.org/news/85
- https://www.imperialviolet.org/2014/12/08/poodleagain.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00124.html
- http://openwall.com/lists/oss-security/2015/03/27/6
- http://openwall.com/lists/oss-security/2015/03/27/9
- http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
- http://www.securityfocus.com/bid/73398
- https://usn.ubuntu.com/3571-1/
- https://web.archive.org/web/20150905124006/http://www.erlang.org/news/85
- https://www.imperialviolet.org/2014/12/08/poodleagain.html
Products affected by CVE-2015-2774
-
cpe:2.3:a:erlang:erlang/otp:-
-
cpe:2.3:a:erlang:erlang/otp:17.0
-
cpe:2.3:a:erlang:erlang/otp:17.0.1
-
cpe:2.3:a:erlang:erlang/otp:17.0.2
-
cpe:2.3:a:erlang:erlang/otp:17.1
-
cpe:2.3:a:erlang:erlang/otp:17.1.1
-
cpe:2.3:a:erlang:erlang/otp:17.1.2
-
cpe:2.3:a:erlang:erlang/otp:17.2
-
cpe:2.3:a:erlang:erlang/otp:17.2.1
-
cpe:2.3:a:erlang:erlang/otp:17.2.2
-
cpe:2.3:a:erlang:erlang/otp:17.3
-
cpe:2.3:a:erlang:erlang/otp:17.3.1
-
cpe:2.3:a:erlang:erlang/otp:17.3.2
-
cpe:2.3:a:erlang:erlang/otp:17.3.3
-
cpe:2.3:a:erlang:erlang/otp:17.3.4
-
cpe:2.3:a:erlang:erlang/otp:17.4
-
cpe:2.3:a:erlang:erlang/otp:17.4.1
-
cpe:2.3:a:erlang:erlang/otp:17.5
-
cpe:2.3:a:erlang:erlang/otp:17.5.1
-
cpe:2.3:a:erlang:erlang/otp:17.5.2
-
cpe:2.3:a:erlang:erlang/otp:17.5.3
-
cpe:2.3:a:erlang:erlang/otp:17.5.4
-
cpe:2.3:a:erlang:erlang/otp:17.5.5
-
cpe:2.3:a:erlang:erlang/otp:17.5.6
-
cpe:2.3:a:erlang:erlang/otp:17.5.6.1
-
cpe:2.3:a:erlang:erlang/otp:17.5.6.10
-
cpe:2.3:a:erlang:erlang/otp:17.5.6.2
-
cpe:2.3:a:erlang:erlang/otp:17.5.6.3
-
cpe:2.3:a:erlang:erlang/otp:17.5.6.4
-
cpe:2.3:a:erlang:erlang/otp:17.5.6.5
-
cpe:2.3:a:erlang:erlang/otp:17.5.6.6
-
cpe:2.3:a:erlang:erlang/otp:17.5.6.7
-
cpe:2.3:a:erlang:erlang/otp:17.5.6.8
-
cpe:2.3:a:erlang:erlang/otp:17.5.6.9
-
cpe:2.3:a:erlang:erlang/otp:18.0
-
cpe:2.3:o:opensuse:opensuse:13.2
-
cpe:2.3:o:oracle:solaris:11.2