PublicDateAtUSN: 2016-04-07
Candidate: CVE-2015-2774
PublicDate: 2016-04-07 21:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2774
 http://www.erlang.org/news/85
 https://ubuntu.com/security/notices/USN-3571-1
Description:
 Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when
 terminating connections, which makes it easier for man-in-the-middle
 attackers to obtain cleartext data via a padding-oracle attack, a variant
 of CVE-2014-3566 (aka POODLE).
Ubuntu-Description:
Notes:
 sbeattie> patch is against erlang 18 prerelease, unclear if 17 and 16
 sbeattie> need fix
Bugs:
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=781839
Priority: low
Discovered-by:
Assigned-to: mdeslaur
CVSS:
 nvd: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N [5.9 MEDIUM]

Patches_erlang:
 upstream: https://github.com/erlang/otp/commit/e53c55dd0ab69982bc511396ccf8655d27c6d38c
upstream_erlang: released (1:17.3-dfsg-4)
lucid_erlang: ignored (reached end-of-life)
precise_erlang: ignored (reached end-of-life)
precise/esm_erlang: DNE (precise was needed)
trusty_erlang: released (1:16.b.3-dfsg-1ubuntu2.2)
trusty/esm_erlang: released (1:16.b.3-dfsg-1ubuntu2.2)
utopic_erlang: ignored (reached end-of-life)
vivid_erlang: ignored (reached end-of-life)
vivid/stable-phone-overlay_erlang: DNE
vivid/ubuntu-core_erlang: DNE
wily_erlang: ignored (reached end-of-life)
xenial_erlang: not-affected (1:18.3-dfsg-1ubuntu3)
esm-infra/xenial_erlang: not-affected (1:18.3-dfsg-1ubuntu3)
yakkety_erlang: not-affected (1:18.3.4.4+dfsg-1ubuntu2)
zesty_erlang: not-affected (1:19.1.6+dfsg-1ubuntu1)
artful_erlang: not-affected (1:19.1.6+dfsg-1ubuntu1)
devel_erlang: not-affected (1:19.1.6+dfsg-1ubuntu1)