Vulnerabilities (CVE)

Join the Common Vulnerabilities and Exposures (CVE) community and start to get notified about new vulnerabilities.

Filtered by vendor Erlang Subscribe
Filtered by product Erlang\/otp
Total 10 CVE
CVE Vendors Products Updated CVSS v2 CVSS v3
CVE-2015-2774 3 Erlang, Opensuse, Oracle 3 Erlang\/otp, Opensuse, Solaris 2023-02-21 4.3 MEDIUM 5.9 MEDIUM
Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
CVE-2022-37026 1 Erlang 1 Erlang\/otp 2022-09-23 N/A 9.8 CRITICAL
In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.
CVE-2021-29221 2 Erlang, Microsoft 2 Erlang\/otp, Windows 2021-04-20 6.2 MEDIUM 7.0 HIGH
A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. By adding files to an existing installation's directory, a local attacker could hijack accounts of other users running Erlang programs or possibly coerce a service running with "erlsrv.exe" to execute arbitrary code as Local System. This can occur only under specific conditions on Windows with unsafe filesystem permissions.
CVE-2020-35733 2 Erlang, Fedoraproject 2 Erlang\/otp, Fedora 2021-03-31 5.0 MEDIUM 7.5 HIGH
An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certification Authority.
CVE-2020-25623 1 Erlang 1 Erlang\/otp 2020-10-09 4.3 MEDIUM 7.5 HIGH
Erlang/OTP 22.3.x before 22.3.4.6 and 23.x before 23.1 allows Directory Traversal. An attacker can send a crafted HTTP request to read arbitrary files, if httpd in the inets application is used.
CVE-2016-1000107 1 Erlang 1 Erlang\/otp 2019-12-19 5.8 MEDIUM 6.1 MEDIUM
inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
CVE-2017-1000385 2 Debian, Erlang 2 Debian Linux, Erlang\/otp 2019-10-02 4.3 MEDIUM 5.9 MEDIUM
The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack).
CVE-2016-10253 1 Erlang 1 Erlang\/otp 2018-07-11 7.5 HIGH 9.8 CRITICAL
An issue was discovered in Erlang/OTP 18.x. Erlang's generation of compiled regular expressions is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset that is used as an array index. This ordinal permits arbitrary regions within the erts_alloc arena to be both read and written to.
CVE-2014-1693 1 Erlang 1 Erlang\/otp 2018-03-15 7.5 HIGH N/A
Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, or (18) append_bin command.
CVE-2011-0766 2 Erlang, Ssh 3 Crypto, Erlang\/otp, Ssh 2011-07-12 7.8 HIGH N/A
The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which makes it easier for remote attackers to guess DSA host and SSH session keys.