Improper Authentication in otp - CVE-2022-37026

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU69581

Improper Authentication in otp - CVE-2022-37026

Published: November 24, 2022 / Updated: April 8, 2026


Vulnerability identifier: #VU69581
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-37026
CWE-ID: CWE-287
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error when handling certain client-certification situations for SSL, TLS, and DTLS. A remote attacker can bypass authentication process and compromise the affected system.


Affected software

otp
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Server for SAP Applications
Server Applications Module
openSUSE Leap
Ubuntu
openEuler
Tenable Identity Exposure (formerly Tenable.ad)
Red Hat OpenStack
Dell EMC VxRail Appliance
erlang (Ubuntu package)
erlang-ssl (Ubuntu package)
erlang
erlang-debuginfo
erlang-debugsource
erlang-epmd
erlang-epmd-debuginfo
erlang-debugger
erlang-wx-src
erlang-wx-debuginfo
erlang-wx
erlang-reltool-src
erlang-debugger-src
erlang-dialyzer
erlang-dialyzer-debuginfo
erlang-dialyzer-src
erlang-diameter
erlang-diameter-src
erlang-doc
erlang-src
erlang-reltool
erlang-observer-src
erlang-observer
erlang-jinterface-src
erlang-jinterface
erlang-et-src
erlang-et
erlang-erts
erlang-erl_docgen
erlang-eunit
erlang-syntax_tools
erlang-os_mon
erlang-tools
erlang-stdlib
erlang-odbc
erlang-sasl
erlang-megaco
erlang-tftp
erlang-snmp
erlang-public_key
erlang-mnesia
erlang-parsetools
erlang-crypto
erlang-inets
erlang-common_test
erlang-ftp
erlang-hipe
erlang-edoc
erlang-erl_interface
erlang-eldap
erlang-compiler
erlang-ssl
erlang-runtime_tools
erlang-examples
erlang-kernel
erlang-asn1
erlang-xmerl
erlang-ssh
erlang (Red Hat package)

How to mitigate CVE-2022-37026

Install updates from vendor's website.

otp - addressed in versions 23.3.4.15, 24.3.4.2, 25.0.2
Tenable Identity Exposure (formerly Tenable.ad) - addressed in versions 3.11.9, 3.19.12, 3.29.4
Dell EMC VxRail Appliance - update to 8.0.120
Red Hat OpenStack - update to 16.2.4
erlang (Ubuntu package) - addressed in versions 1:22.2.7+dfsg-1ubuntu0.2, 1:24.2.1+dfsg-1ubuntu0.1, 1:24.3.4.1+dfsg-1ubuntu0.1
erlang-ssl (Ubuntu package) - addressed in versions 1:22.2.7+dfsg-1ubuntu0.2, 1:24.2.1+dfsg-1ubuntu0.1, 1:24.3.4.1+dfsg-1ubuntu0.1
erlang - addressed in versions 22.2.7-150200.3.3.1, 22.2.7-150200.3.8.1, 22.3-150300.3.3.1, 22.3-150300.3.8.1, 23.3.4.19-150300.3.11.1
erlang-debuginfo - addressed in versions 22.2.7-150200.3.3.1, 22.2.7-150200.3.8.1, 22.3-150300.3.3.1, 22.3-150300.3.8.1, 23.3.4.19-150300.3.11.1
erlang-debugsource - addressed in versions 22.2.7-150200.3.3.1, 22.2.7-150200.3.8.1, 22.3-150300.3.3.1, 22.3-150300.3.8.1, 23.3.4.19-150300.3.11.1
erlang-epmd - addressed in versions 22.2.7-150200.3.3.1, 22.2.7-150200.3.8.1, 22.3-150300.3.3.1, 22.3-150300.3.8.1, 23.3.4.19-150300.3.11.1
erlang-epmd-debuginfo - addressed in versions 22.2.7-150200.3.3.1, 22.2.7-150200.3.8.1, 22.3-150300.3.3.1, 22.3-150300.3.8.1, 23.3.4.19-150300.3.11.1
erlang-debugger - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-wx-src - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-wx-debuginfo - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-wx - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-reltool-src - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-debugger-src - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-dialyzer - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-dialyzer-debuginfo - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-dialyzer-src - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-diameter - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-diameter-src - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-doc - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-src - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-reltool - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-observer-src - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-observer - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-jinterface-src - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-jinterface - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-et-src - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-et - addressed in versions 22.3-150300.3.3.1, 22.3-150300.3.8.1
erlang-erts - update to 23.3.4.9-3
erlang-erl_docgen - update to 23.3.4.9-3
erlang-eunit - update to 23.3.4.9-3
erlang-syntax_tools - update to 23.3.4.9-3
erlang-debugsource - update to 23.3.4.9-3
erlang-os_mon - update to 23.3.4.9-3
erlang-tools - update to 23.3.4.9-3
erlang-stdlib - update to 23.3.4.9-3
erlang-odbc - update to 23.3.4.9-3
erlang - update to 23.3.4.9-3
erlang-sasl - update to 23.3.4.9-3
erlang-observer - update to 23.3.4.9-3
erlang-megaco - update to 23.3.4.9-3
erlang-debuginfo - update to 23.3.4.9-3
erlang-tftp - update to 23.3.4.9-3
erlang-snmp - update to 23.3.4.9-3
erlang-public_key - update to 23.3.4.9-3
erlang-mnesia - update to 23.3.4.9-3
erlang-parsetools - update to 23.3.4.9-3
erlang-crypto - update to 23.3.4.9-3
erlang-inets - update to 23.3.4.9-3
erlang-common_test - update to 23.3.4.9-3
erlang-ftp - update to 23.3.4.9-3
erlang-jinterface - update to 23.3.4.9-3
erlang-diameter - update to 23.3.4.9-3
erlang-hipe - update to 23.3.4.9-3
erlang-edoc - update to 23.3.4.9-3
erlang-debugger - update to 23.3.4.9-3
erlang-et - update to 23.3.4.9-3
erlang-erl_interface - update to 23.3.4.9-3
erlang-eldap - update to 23.3.4.9-3
erlang-compiler - update to 23.3.4.9-3
erlang-ssl - update to 23.3.4.9-3
erlang-wx - update to 23.3.4.9-3
erlang-reltool - update to 23.3.4.9-3
erlang-dialyzer - update to 23.3.4.9-3
erlang-runtime_tools - update to 23.3.4.9-3
erlang-examples - update to 23.3.4.9-3
erlang-kernel - update to 23.3.4.9-3
erlang-asn1 - update to 23.3.4.9-3
erlang-xmerl - update to 23.3.4.9-3
erlang-ssh - update to 23.3.4.9-3
erlang (Red Hat package) - update to 23.3.4.18-1.el8ost

External References

Related Security Bulletins