PT-2026-64988 · Unknown+1 · Erlang/Otp+1
CVSS v4.0
9.1
Critical
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Erlang/OTP versions 17.0 through 27.3.4.14
Erlang/OTP versions 28.0 through 28.5.0.3
Erlang/OTP versions 29.0 through 29.0.3
ssl versions 5.3.4 through 11.2.12.10
ssl versions 11.6.0 through 11.6.0.3
ssl versions 11.7.0 through 11.7.3
Description
The TLS 1.2 (and earlier) and DTLS client fails to verify if the cipher suite selected by the server in the ServerHello message was actually offered by the client in the ClientHello message. The
tls handshake:hello/5 handler validates the protocol version and downgrade sentinel but passes the server-chosen suite to ssl handshake:handle server hello extensions/9 without a membership check. An on-path attacker can force the use of anonymous key exchange suites, such as TLS DH anon * or TLS ECDH anon *, which do not require server certificates. This bypasses the verify peer and cacerts configurations, allowing the attacker to complete the handshake without certificate or hostname validation, making all subsequent application traffic readable and modifiable.Recommendations
Update Erlang/OTP to version 27.3.4.15 or later.
Update Erlang/OTP to version 28.5.0.4 or later.
Update Erlang/OTP to version 29.0.4 or later.
Update ssl to version 11.2.12.11 or later.
Update ssl to version 11.6.0.4 or later.
Update ssl to version 11.7.4 or later.
Restrict client connections to TLS 1.3 only by setting versions to
['tlsv1.3'] in the client's ssl options.Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Erlang/Otp
Ssl