yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP virtual machine with a version less than 21.0.
References
Link | Resource |
---|---|
https://github.com/erlyaws/yaws/blob/c0fd79f17d52628fcec527da7fa3e788c283c445/src/yaws_config.erl#L2068-L2075 | Exploit Third Party Advisory |
https://github.com/erlyaws/yaws/issues/402 | Issue Tracking Third Party Advisory |
https://github.com/erlyaws/yaws/releases | Release Notes Third Party Advisory |
https://medium.com/%40charlielabs101/cve-2020-12872-df315411aa70 | |
https://sweet32.info/ | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2020-05-15T18:20:07
Updated: 2020-09-14T20:21:49
Reserved: 2020-05-14T00:00:00
Link: CVE-2020-12872
JSON object: View
NVD Information
Status : Modified
Published: 2020-05-15T19:15:12.087
Modified: 2023-11-07T03:15:45.720
Link: CVE-2020-12872
JSON object: View
Redhat Information
No data.
CWE