Erlang TLS Server Adaptive Chosen Ciphertext Attack Vulnerability
Summary
DLA-1207-1: erlang - security update. Affects erlang versions < 1:15.b.1-dfsg-4+deb7u2. Fixed in 1:15.b.1-dfsg-4+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Erlang is a programming language and runtime environment used for building scalable and fault-tolerant systems. It includes a TLS server component that allows secure communication over the network. The TLS server in Erlang supports cipher suites using RSA key exchange. However, it has been discovered that this configuration is vulnerable to an Adaptive Chosen Ciphertext attack (also known as the Bleichenbacher attack) against RSA.
Vulnerability Detail
The Adaptive Chosen Ciphertext attack allows an attacker to recover plaintext of encrypted messages and perform a Man-in-the-Middle attack without having access to the server's private key. This vulnerability arises due to a flaw in the RSA key exchange implementation in the Erlang TLS server. Exploiting this vulnerability can lead to unauthorized access to sensitive information and compromise the integrity and confidentiality of the communication.
How To Fix
Minimum fixed version
1:15.b.1-dfsg-4+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade erlangTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to mitigate the risk.
Conclusion
The Erlang TLS server is vulnerable to an Adaptive Chosen Ciphertext attack against RSA key exchange. This can lead to plaintext recovery of encrypted messages and enable a Man-in-the-Middle attack. It is recommended to upgrade the Erlang package to the fixed version to address this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for erlang →
FAQ
An Adaptive Chosen Ciphertext attack is a cryptographic attack that allows an attacker to recover plaintext of encrypted messages by manipulating ciphertexts and observing the server's response.
Exploiting this vulnerability can result in the recovery of plaintext of encrypted messages and enable a Man-in-the-Middle attack, compromising the confidentiality and integrity of the communication.
This vulnerability specifically affects Erlang TLS servers configured with cipher suites using RSA key exchange. If your system does not use this configuration, it is not vulnerable to this specific issue.
Yes, an attacker can exploit this vulnerability remotely by sending specially crafted ciphertexts to the vulnerable Erlang TLS server.
There are no known instances of this vulnerability being exploited in the wild at the time of this advisory. However, it is crucial to apply the security update to mitigate the risk.
Related vulnerabilities
Recent vulnerabilities recorded for erlang.
