CVE-2022-37026: Critical severity erlang/otp vulnerability
Published Sep 21, 2022
·Updated
In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.
Affected Software
8 affected componentsFixes available
ubuntu/erlang<1:22.2.7+dfsg-1ubuntu0.2
1:22.2.7+dfsg-1ubuntu0.2
ubuntu/erlang<1:24.2.1+dfsg-1ubuntu0.1
1:24.2.1+dfsg-1ubuntu0.1
ubuntu/erlang<1:24.3.4.1+dfsg-1ubuntu0.1
1:24.3.4.1+dfsg-1ubuntu0.1
ubuntu/erlang<1:24.3.4.5+dfsg-1
1:24.3.4.5+dfsg-1
debian/erlang<=1:21.2.6+dfsg-1
1:23.2.6+dfsg-1+deb11u11:25.2.3+dfsg-1
Erlang Erlang\/otp<23.3.4.15
Erlang Erlang\/otp>=24.0<24.3.4.2
Erlang Erlang\/otp>=25.0<25.0.2
Remediation
Event History
Sep 21, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
May 9, 2023
Data Sourced
09:25 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2022-37026?
CVE-2022-37026 is classified as a medium severity vulnerability due to potential client authentication bypass.
2
How do I fix CVE-2022-37026?
To resolve CVE-2022-37026, upgrade Erlang/OTP to version 23.3.4.15 or later, 24.3.4.2 or later, or 25.0.2 or later.
3
What versions of Erlang/OTP are affected by CVE-2022-37026?
CVE-2022-37026 affects Erlang/OTP versions before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2.
4
Who is impacted by CVE-2022-37026?
Users of affected versions of Erlang/OTP utilizing SSL, TLS, and DTLS client authentication are impacted by CVE-2022-37026.
5
Is CVE-2022-37026 a client-side or server-side vulnerability?
CVE-2022-37026 is primarily a client-side vulnerability relating to SSL/TLS authentication mechanisms.