漏洞描述
The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack).
影响产品
暂无结构化产品信息。
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
lists.debian.orghttps://lists.debian.org/debian-lts-announce/2017/12/msg00010.html↗www.kb.cert.orghttps://www.kb.cert.org/vuls/id/144389↗www.securityfocus.comhttp://www.securityfocus.com/bid/102197↗access.redhat.comhttps://access.redhat.com/errata/RHSA-2018:0528↗erlang.orghttp://erlang.org/pipermail/erlang-questions/2017-November/094255.html↗access.redhat.comhttps://access.redhat.com/errata/RHSA-2018:0303↗www.debian.orghttps://www.debian.org/security/2017/dsa-4057↗access.redhat.comhttps://access.redhat.com/errata/RHSA-2018:0368↗usn.ubuntu.comhttps://usn.ubuntu.com/3571-1/↗access.redhat.comhttps://access.redhat.com/errata/RHSA-2018:0242↗erlang.orghttp://erlang.org/pipermail/erlang-questions/2017-November/094257.html↗robotattack.orghttps://robotattack.org/↗erlang.orghttp://erlang.org/pipermail/erlang-questions/2017-November/094256.html↗