CVE-2015-2774

Published: Apr 7, 2016Modified: May 6, 2026

5.9

Vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).

Affected (3)

Products: Erlang: Erlang/otp · Oracle: Solaris · Opensuse: Opensuse

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Erlang Erlang/otp	Up to 18.0

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Oracle Solaris	Version 11.2

Configuration C

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 13.2

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (16)

http://lists.opensuse.org/opensuse-updates/2016-02/msg00124.html

Source: cve@mitre.org

Third Party Advisory

http://openwall.com/lists/oss-security/2015/03/27/6

Source: cve@mitre.org

Third Party Advisory

http://openwall.com/lists/oss-security/2015/03/27/9

Source: cve@mitre.org

http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/bid/73398

Source: cve@mitre.org

https://usn.ubuntu.com/3571-1/

Source: cve@mitre.org

https://web.archive.org/web/20150905124006/http://www.erlang.org/news/85

Source: cve@mitre.org

Release Notes

https://www.imperialviolet.org/2014/12/08/poodleagain.html

Source: cve@mitre.org

Technical Description

http://lists.opensuse.org/opensuse-updates/2016-02/msg00124.html