{"id":"CVE-2015-2774","published":"2016-04-07T21:00:00Z","modified":"2024-08-06T05:24:39Z","title":"Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it…","vendor":null,"product":null,"tier":"tail","description":{"text":"Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01899,"percentile":0.79586,"provenance":"source"},"cwes":[],"references":[{"url":"https://usn.ubuntu.com/3571-1/","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"https://web.archive.org/web/20150905124006/http://www.erlang.org/news/85","tags":["x_refsource_CONFIRM"]},{"url":"https://www.imperialviolet.org/2014/12/08/poodleagain.html","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/bid/73398","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-02/msg00124.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://openwall.com/lists/oss-security/2015/03/27/9","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html","tags":["x_refsource_CONFIRM"]},{"url":"http://openwall.com/lists/oss-security/2015/03/27/6","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":15.9,"factors":[{"name":"EPSS percentile","points":15.92}]},"euvd":{"id":"EUVD-2015-2864","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-cve-2014-3566-family-cve-2014-3566","parents":[{"from":"CVE-2014-3566","to":"CVE-2015-2774","relation":"variant","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"variant","quote":"…P before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).","from":"CVE.org","in":"CVE-2015-2774"}]}]}}