Erlang SSL Application Vulnerability - DEBIAN-CVE-2024-53846: Peer Verification Flaw
Summary
DEBIAN-CVE-2024-53846: OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. Affects erlang versions < 1:27.2+dfsg-1. Fixed in 1:27.2+dfsg-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Erlang is a programming language used for building scalable and maintainable applications, particularly in telecommunications and distributed systems. The Open Telecom Platform (OTP) is a set of Erlang libraries that includes the Erlang runtime system and various components. The ssl application within OTP is responsible for implementing SSL/TLS protocols, ensuring secure communication over networks. However, a regression in recent versions has introduced a critical flaw in how peer verification is conducted.
Vulnerability Detail
The vulnerability arises from a regression introduced in the ssl application of OTP starting from versions OTP-25.3.2.8, OTP-26.2, and OTP-27.0. This flaw allows a server or client to incorrectly verify the peer when presented with incorrect extended key usage. For instance, a server may mistakenly verify a client that has server authentication extended key usage, and vice versa. This could lead to unauthorized access or man-in-the-middle attacks, compromising the security of communications.
How To Fix
Minimum fixed version
1:27.2+dfsg-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade erlangTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling SSL/TLS verification until the package can be updated. However, this is not recommended for production environments as it may expose your application to security risks.
Conclusion
The vulnerability identified as DEBIAN-CVE-2024-53846 poses a significant risk to applications using the Erlang SSL application due to incorrect peer verification. It is crucial to update to the patched version to mitigate potential security threats.
See every vulnerability recorded for erlang →
FAQ
The vulnerability is a regression in the SSL application of Erlang's OTP that affects peer verification based on extended key usage.
The affected versions are OTP-25.3.2.8, OTP-26.2, and OTP-27.0.
The flaw could lead to unauthorized access or man-in-the-middle attacks, compromising the security of data transmitted over SSL/TLS.
You can use Vulert, which monitors open-source vulnerabilities in your software. Simply upload your manifest file like package-lock.json to check for vulnerabilities.
Yes, using Vulert's playground, you can check if your application is affected by this vulnerability without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for erlang.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
