CVE-2020-35733

NameCVE-2020-35733
DescriptionAn issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certification Authority.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium
Debian Bugs980199

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
erlang (PTS)stretch1:19.2.1+dfsg-2+deb9u3fixed
stretch (security)1:19.2.1+dfsg-2+deb9u1fixed
buster1:21.2.6+dfsg-1fixed
bullseye1:23.2.6+dfsg-1fixed
bookworm1:24.0.6+dfsg-2fixed
sid1:24.1.1+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
erlangsourcestretch(not affected)
erlangsourcebuster(not affected)
erlangsource(unstable)1:23.2.2+dfsg-1980199

Notes

[buster] - erlang <not-affected> (Vulnerable code introduced later)
[stretch] - erlang <not-affected> (Vulnerable code introduced later)
https://erlang.org/pipermail/erlang-questions/2021-January/100357.html
Introduced in: https://github.com/erlang/otp/commit/d24a220c3b867caef83026ba31d2656366da4322 (OTP-23.2)
Fixed by: https://github.com/erlang/otp/commit/a59f3c4d2be19343f43c46241d0f4e30dd5563de (OTP-23.2.2)
Fixed by: https://github.com/erlang/otp/commit/c515e8d74fb92430c619eaa2dd00c89d94c6770a (OTP-23.2.2)
Fixed by: https://github.com/erlang/otp/commit/11a098cb0bcc30d7c424f01c60bfefd1deece287 (OTP-23.2.2)
Fixed by: https://github.com/erlang/otp/commit/95222bb877515345d6716f3bc36139ab52211af0 (OTP-23.2.2)

Search for package or bug name: Reporting problems