PT-2022-6747 · Ericsson+6 · Erlang/Otp+6

Published 2022-06-17 · Updated 2025-11-18 · CVE-2022-37026

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Erlang/OTP versions prior to 23.3.4.15 Erlang/OTP versions 24.x prior to 24.3.4.2 Erlang/OTP versions 25.x prior to 25.0.2

Description The issue is related to a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS. This allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The vulnerability is associated with deficiencies in the authentication procedure.

Recommendations For Erlang/OTP versions prior to 23.3.4.15, update to version 23.3.4.15 or later. For Erlang/OTP versions 24.x prior to 24.3.4.2, update to version 24.3.4.2 or later. For Erlang/OTP versions 25.x prior to 25.0.2, update to version 25.0.2 or later.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALT-PU-2022-2944

ALT-PU-2022-3187

ALT-PU-2024-9499

BDU:2023-03852

CVE-2022-37026

DLA-3491-1

MGASA-2022-0450

OESA-2023-1912

OESA-2023-1941

OESA-2023-1942

OPENSUSE-SU-2022_4215-1

OPENSUSE-SU-2023_3401-1

OPENSUSE-SU-2024:12416-1

OPENSUSE-SU-2025:15740-1

RHSA-2022:8857

SUSE-SU-2022:4215-1

SUSE-SU-2022:4222-1

SUSE-SU-2022_4215-1

SUSE-SU-2022_4222-1

SUSE-SU-2023:3401-1

SUSE-SU-2023:3409-1

SUSE-SU-2023:4109-1

SUSE-SU-2023_3401-1

SUSE-SU-2023_3409-1

SUSE-SU-2023_4109-1

USN-6059-1

Affected Products

Alt Linux

Astra Linux

Erlang/Otp

Linuxmint

Red Os

Suse

Ubuntu

References · 55

• https://github.com/erlang/otp/compare/OTP-23.3.4.14...OTP-23.3.4.15 · Patch
• https://cve.org/CVERecord?id=CVE-2022-37026 · Security Note
• https://erlangforums.com/t/otp-25-1-released/1854 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-37026 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12416-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1912 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15740-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-37026 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-37026 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-37026 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1941 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0907SE47 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0450.html · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2022:4215-1 · Vendor Advisory