Your submission was sent successfully! Close

CVE-2017-1000385

Published: 12 December 2017

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack).

Priority

Medium

CVSS 3 base score: 5.9

Status

Package Release Status
erlang
Launchpad, Ubuntu, Debian
Upstream Needs triage

Ubuntu 16.04 ESM (Xenial Xerus)
Released (1:18.3-dfsg-1ubuntu3.1)
Ubuntu 14.04 ESM (Trusty Tahr)
Released (1:16.b.3-dfsg-1ubuntu2.2)
Patches:
Upstream: https://github.com/erlang/otp/commit/38b07caa2a1c6cd3537eadd36770afa54f067562 (OTP-20.1.7)
Upstream: https://github.com/erlang/otp/commit/3b4386dd19b7e669f557c95ace8d7ba228291927 (OTP-19.3.6.4)
Upstream: https://github.com/erlang/otp/commit/de3b9cdb8521d7edd524b4e17d1e3f883f832ec0 (OTP-18.3.4.7)