CVE-2022-37026: Critical severity Erlang Erlang\/otp vulnerability
In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/erlangto a version that resolves this vulnerability.Fixed in 1:22.2.7+dfsg-1ubuntu0.2 - Upgrade
Upgrade
ubuntu/erlangto a version that resolves this vulnerability.Fixed in 1:24.2.1+dfsg-1ubuntu0.1 - Upgrade
Upgrade
ubuntu/erlangto a version that resolves this vulnerability.Fixed in 1:24.3.4.1+dfsg-1ubuntu0.1 - Upgrade
Upgrade
ubuntu/erlangto a version that resolves this vulnerability.Fixed in 1:24.3.4.5+dfsg-1 - Upgrade
Upgrade
debian/erlangto a version that resolves this vulnerability.Fixed in 1:23.2.6+dfsg-1+deb11u1Fixed in 1:25.2.3+dfsg-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-37026?
CVE-2022-37026 is classified as a medium severity vulnerability due to potential client authentication bypass.
How do I fix CVE-2022-37026?
To resolve CVE-2022-37026, upgrade Erlang/OTP to version 23.3.4.15 or later, 24.3.4.2 or later, or 25.0.2 or later.
What versions of Erlang/OTP are affected by CVE-2022-37026?
CVE-2022-37026 affects Erlang/OTP versions before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2.
Who is impacted by CVE-2022-37026?
Users of affected versions of Erlang/OTP utilizing SSL, TLS, and DTLS client authentication are impacted by CVE-2022-37026.
Is CVE-2022-37026 a client-side or server-side vulnerability?
CVE-2022-37026 is primarily a client-side vulnerability relating to SSL/TLS authentication mechanisms.