PT-2024-10115 · Ericsson+3 · Erlang/Otp+3

Starbelly · Published 2024-12-05 · Updated 2026-01-14 · CVE-2024-53846

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Erlang OTP versions 25.3.2.8 through 27.0 Erlang OTP version 26.2 Erlang OTP versions prior to 27.1.3

Description A regression in the ssl application of Erlang OTP causes a server or client to verify the peer even when incorrect extended key usage is presented. This issue can be exploited by a remote attacker to conduct a man-in-the-middle (MitM) attack, allowing unauthorized access. The vulnerability is related to errors in the certificate authentication procedure and incorrect certificate checking.

Recommendations For Erlang OTP versions 25.3.2.8 through 27.0, upgrade to a version later than 27.1.3. For Erlang OTP version 26.2, upgrade to a version later than 27.1.3. For Erlang OTP versions prior to 27.1.3, upgrade to version 27.1.3 or later. As a temporary workaround, consider restricting the use of the ssl application until a patch is available.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

AZL-54051

BDU:2025-00339

CVE-2024-53846

GHSA-QW6R-QH9V-638V

USN-7961-1

Affected Products

Erlang/Otp

Linuxmint

Red Os

Ubuntu

References · 20

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53846.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-53846 · Security Note
• https://osv.dev/vulnerability/AZL-54051 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-53846 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7961-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7961-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-53846 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-53846 · Security Note
• https://bdu.fstec.ru/vul/2025-00339 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-53846 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-53846 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-53846 · Vendor Advisory
• https://github.com/erlang/otp/security/advisories/GHSA-qw6r-qh9v-638v · Note
• https://redos.red-soft.ru/support/secure · Note
• https://twitter.com/VulmonFeeds/status/1864819313590386952 · Twitter Post