CVE-2015-2774: Infoleak
Published Apr 7, 2016
·Updated
Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
Affected Software
4 affected componentsFixes available
Erlang Erlang\/otp<=18.0
Oracle Solaris=11.2
openSUSE openSUSE=13.2
debian/erlang
1:23.2.6+dfsg-1+deb11u11:23.2.6+dfsg-1+deb11u31:25.2.3+dfsg-1+deb12u31:25.2.3+dfsg-1+deb12u11:27.3.4.1+dfsg-11:27.3.4.6+dfsg-1
Remediation
Event History
Apr 7, 2016
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Data Sourced
via NVD·09:59 PM
DescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·10:08 PM
Description
Feb 19, 2026
Data Sourced
via Ubuntu·06:34 PM
RemedyDescriptionSeverityAffected Software
Data Sourced
via Debian·06:34 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2015-2774?
CVE-2015-2774 has a medium severity due to its potential to enable man-in-the-middle attacks.
2
How do I fix CVE-2015-2774?
To mitigate CVE-2015-2774, upgrade Erlang/OTP to version 18.0 or later.
3
What impact does CVE-2015-2774 have on my system?
CVE-2015-2774 can allow attackers to exploit padding oracle attacks to retrieve sensitive cleartext data.
4
Which versions of Erlang/OTP are affected by CVE-2015-2774?
CVE-2015-2774 affects all versions of Erlang/OTP prior to 18.0.
5
Is CVE-2015-2774 specific to any operating systems?
CVE-2015-2774 affects multiple systems including Debian, Oracle Solaris, and openSUSE.