CVE-2020-12872: Weak Encryption
Published May 15, 2020
·Updated
yawsconfig.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP virtual machine with a version less than 21.0.
Affected Software
1 affected component
Yaws yaws>=2.0.2<=2.0.6
Event History
May 15, 2020
CVE Published
via MITRE·06:20 PM
Data Sourced
via MITRE·06:20 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2020-12872?
CVE-2020-12872 has a medium severity level due to the potential exposure to Sweet32 attacks.
2
How do I fix CVE-2020-12872?
To fix CVE-2020-12872, update Yaws to version 2.0.8 or later or ensure your Erlang/OTP version is 21.0 or higher.
3
What kind of attacks is CVE-2020-12872 vulnerable to?
CVE-2020-12872 is vulnerable to Sweet32 attacks due to the use of obsolete TLS ciphers.
4
Which versions of Yaws are affected by CVE-2020-12872?
CVE-2020-12872 affects Yaws versions 2.0.2 to 2.0.7.
5
What component of Yaws does CVE-2020-12872 impact?
CVE-2020-12872 impacts the yaws_config.erl component in Yaws software.