PT-2020-13308 · Yaws+1 · Yaws+1

Published 2020-05-15 · Updated 2023-01-20 · CVE-2020-12872

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Yaws versions 2.0.2 through 2.0.7

Description The issue concerns the loading of obsolete TLS ciphers in Yaws, which can be exploited for Sweet32 attacks. This occurs when Yaws is running on an Erlang/OTP virtual machine with a version less than 21.0.

Recommendations For Yaws versions 2.0.2 through 2.0.7, consider updating the Erlang/OTP virtual machine to version 21.0 or later to mitigate the risk of obsolete TLS ciphers being loaded. As a temporary workaround, consider disabling the use of obsolete TLS ciphers in the yaws config.erl configuration file until a patch is available.

Exploit

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2020-12872

Affected Products

Erlang/Otp

Yaws

References · 14

• 🔥 https://github.com/erlyaws/yaws/blob/c0fd79f17d52628fcec527da7fa3e788c283c445/src/yaws_config.erl#L2068-L2075 · Exploit
• 🔥 https://medium.com/@charlielabs101/cve-2020-12872-df315411aa70 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-12872 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-12872 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-12872 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-12872 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-12872 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-12872 · Security Note
• https://ubuntu.com/security/CVE-2020-12872 · Vendor Advisory
• https://github.com/erlyaws/yaws/issues/402 · Note
• https://github.com/erlyaws/yaws/releases · Note
• https://medium.com/%40charlielabs101/cve-2020-12872-df315411aa70 · Note
• https://t.me/cvenotify/3853 · Telegram Post
• https://sweet32.info · Note