CVE-2024-53846

MEDIUM EPSS 15.6%

Published Dec 5, 20241y ago · Modified Jun 17, 20261w ago

5.5 CVSS 3.1

Medium

Published Dec 5, 2024 1y ago

Last Modified Jun 17, 2026 1w ago

Description

OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).

CVSS Details

Base Score

5.5

Exploitability

1.3

Impact

3.7

Vector string

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

Attack Vector Network

Attack Complexity High

Privileges Required High

User Interaction None

Scope Changed

Confidentiality Low

Integrity Low

Availability Low

Threat Intelligence

EPSS Exploit Probability

15.6% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-295

References 1

github.com https://github.com/erlang/otp/security/advisories/GHSA-qw6r-qh9v-638v

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.