Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
| Link | Tags |
|---|---|
| https://usn.ubuntu.com/3571-1/ | vendor advisory |
| https://web.archive.org/web/20150905124006/http://www.erlang.org/news/85 | release notes |
| https://www.imperialviolet.org/2014/12/08/poodleagain.html | technical description |
| http://www.securityfocus.com/bid/73398 | vdb entry |
| http://lists.opensuse.org/opensuse-updates/2016-02/msg00124.html | third party advisory vendor advisory |
| http://openwall.com/lists/oss-security/2015/03/27/9 | mailing list |
| http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html | third party advisory |
| http://openwall.com/lists/oss-security/2015/03/27/6 | third party advisory mailing list |