CVE-2024-53846

Katalog CVE

CVSS 5.5 · Medium EPSS 0,26%

Kerentanan Improper Certificate Validation. Skor CVSS 3.1 5.5 (Medium) menurut github.com.

Deskripsi (NVD)

OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).

Rincian

Terbit di NVD

5 Desember 2024

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

5.5 (Medium), sumber github.com
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-295: Improper Certificate Validation

EPSS (30 hari)

0,26% peluang dieksploitasi; lebih tinggi dari 16,8% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/erlang/otp/security/advisories/GHSA-qw6r-qh9v-638v