openEuler update for erlang
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2023-48795 |
| CWE-ID | CWE-326 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software |
openEuler Operating systems & Components / Operating system erlang-eunit Operating systems & Components / Operating system package or component erlang-megaco Operating systems & Components / Operating system package or component erlang-tftp Operating systems & Components / Operating system package or component erlang-hipe Operating systems & Components / Operating system package or component erlang-ssl Operating systems & Components / Operating system package or component erlang-mnesia Operating systems & Components / Operating system package or component erlang-public_key Operating systems & Components / Operating system package or component erlang-observer Operating systems & Components / Operating system package or component erlang-ftp Operating systems & Components / Operating system package or component erlang-syntax_tools Operating systems & Components / Operating system package or component erlang-jinterface Operating systems & Components / Operating system package or component erlang-sasl Operating systems & Components / Operating system package or component erlang-xmerl Operating systems & Components / Operating system package or component erlang-os_mon Operating systems & Components / Operating system package or component erlang-tools Operating systems & Components / Operating system package or component erlang-runtime_tools Operating systems & Components / Operating system package or component erlang-crypto Operating systems & Components / Operating system package or component erlang-debugsource Operating systems & Components / Operating system package or component erlang-erl_interface Operating systems & Components / Operating system package or component erlang-eldap Operating systems & Components / Operating system package or component erlang-odbc Operating systems & Components / Operating system package or component erlang-dialyzer Operating systems & Components / Operating system package or component erlang-reltool Operating systems & Components / Operating system package or component erlang-asn1 Operating systems & Components / Operating system package or component erlang-erl_docgen Operating systems & Components / Operating system package or component erlang-wx Operating systems & Components / Operating system package or component erlang-debuginfo Operating systems & Components / Operating system package or component erlang-snmp Operating systems & Components / Operating system package or component erlang-compiler Operating systems & Components / Operating system package or component erlang-kernel Operating systems & Components / Operating system package or component erlang-diameter Operating systems & Components / Operating system package or component erlang-stdlib Operating systems & Components / Operating system package or component erlang-edoc Operating systems & Components / Operating system package or component erlang-debugger Operating systems & Components / Operating system package or component erlang-ssh Operating systems & Components / Operating system package or component erlang-parsetools Operating systems & Components / Operating system package or component erlang-et Operating systems & Components / Operating system package or component erlang-inets Operating systems & Components / Operating system package or component erlang-common_test Operating systems & Components / Operating system package or component erlang-otp_mibs Operating systems & Components / Operating system package or component erlang-examples Operating systems & Components / Operating system package or component erlang-erts Operating systems & Components / Operating system package or component erlang Operating systems & Components / Operating system package or component |
| Vendor | openEuler |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Inadequate encryption strength
EUVDB-ID: #VU84537
Risk: Low
CVSSv4.0: 2.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear]
CVE-ID: CVE-2023-48795
CWE-ID:
CWE-326 - Inadequate Encryption Strength
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to incorrect implementation of the SSH Binary Packet Protocol (BPP), which mishandles the handshake phase and the use of sequence numbers. A remote attacker can perform MitM attack and delete the SSH2_MSG_EXT_INFO message sent before authentication starts, allowing the attacker to disable a subset of the keystroke timing obfuscation features introduced in OpenSSH 9.5.
The vulnerability was dubbed "Terrapin attack" and it affects both client and server implementations.
Install updates from vendor's repository.
Vulnerable software versionsopenEuler: 20.03 LTS SP1 - 22.03 LTS SP3
erlang-eunit: before 21.3.3-4
erlang-megaco: before 21.3.3-4
erlang-tftp: before 21.3.3-4
erlang-hipe: before 21.3.3-4
erlang-ssl: before 21.3.3-4
erlang-mnesia: before 21.3.3-4
erlang-public_key: before 21.3.3-4
erlang-observer: before 21.3.3-4
erlang-ftp: before 21.3.3-4
erlang-syntax_tools: before 21.3.3-4
erlang-jinterface: before 21.3.3-4
erlang-sasl: before 21.3.3-4
erlang-xmerl: before 21.3.3-4
erlang-os_mon: before 21.3.3-4
erlang-tools: before 21.3.3-4
erlang-runtime_tools: before 21.3.3-4
erlang-crypto: before 21.3.3-4
erlang-debugsource: before 21.3.3-4
erlang-erl_interface: before 21.3.3-4
erlang-eldap: before 21.3.3-4
erlang-odbc: before 21.3.3-4
erlang-dialyzer: before 21.3.3-4
erlang-reltool: before 21.3.3-4
erlang-asn1: before 21.3.3-4
erlang-erl_docgen: before 21.3.3-4
erlang-wx: before 21.3.3-4
erlang-debuginfo: before 21.3.3-4
erlang-snmp: before 21.3.3-4
erlang-compiler: before 21.3.3-4
erlang-kernel: before 21.3.3-4
erlang-diameter: before 21.3.3-4
erlang-stdlib: before 21.3.3-4
erlang-edoc: before 21.3.3-4
erlang-debugger: before 21.3.3-4
erlang-ssh: before 21.3.3-4
erlang-parsetools: before 21.3.3-4
erlang-et: before 21.3.3-4
erlang-inets: before 21.3.3-4
erlang-common_test: before 21.3.3-4
erlang-otp_mibs: before 21.3.3-4
erlang-examples: before 21.3.3-4
erlang-erts: before 21.3.3-4
erlang: before 21.3.3-4
CPE2.3- cpe:2.3:o:openeuler:openeuler:20.03:LTS SP1:*:*:*:*:*:*
- cpe:2.3:o:openeuler:openeuler:20.03:LTS SP4:*:*:*:*:*:*
- cpe:2.3:o:openeuler:openeuler:22.03:LTS:*:*:*:*:*:*
- cpe:2.3:a:openeuler:erlang-eunit:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-megaco:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-tftp:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-hipe:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-ssl:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-mnesia:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-public_key:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-observer:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-ftp:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-syntax_tools:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-jinterface:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-sasl:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-xmerl:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-os_mon:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-tools:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-runtime_tools:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-crypto:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-debugsource:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-erl_interface:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-eldap:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-odbc:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-dialyzer:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-reltool:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-asn1:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-erl_docgen:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-wx:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-debuginfo:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-snmp:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-compiler:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-kernel:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-diameter:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-stdlib:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-edoc:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-debugger:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-ssh:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-parsetools:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-et:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-inets:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-common_test:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-otp_mibs:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-examples:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang-erts:*:*:*:*:*:openeuler:*:*
- cpe:2.3:a:openeuler:erlang:*:*:*:*:*:openeuler:*:*
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2024-1122
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
