Summary
It was discovered that Erlang did not properly implement TLS client
certificate validation during the TLS handshake. A remote attacker could
use this issue to bypass client authentication.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | erlang | 1:22.2.7+dfsg-1ubuntu0.2 |
| Ubuntu · 22.04 LTS 22.04:LTS | erlang | 1:24.2.1+dfsg-1ubuntu0.1 |
Vulnerabilities 1
-
Critical 9.8
In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass i…
References
-
report
https://ubuntu.com/security/CVE-2022-37026