« Volver al listado

CVE-2024-53846

Estado: AplazadaMedia (5.5)—

OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Erlang — OTPAIErlang — SSLAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-53846",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-53846",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-06T16:04:29.566469Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 1.3
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "erlang",
          "product": "otp",
          "versions": [
            {
              "status": "affected",
              "version": ">= 25.3.2.8, <= 25.3.2.16"
            },
            {
              "status": "affected",
              "version": ">= 26.2, <= 26.2.5.6"
            },
            {
              "status": "affected",
              "version": ">= 27.0, <= 27.1.3"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:erlang:otp:*:*:*:*:*:*:*:*"
          ],
          "vendor": "erlang",
          "product": "otp",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "25.3.2.8"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-12-05T17:15:14.477",
  "references": [
    {
      "url": "https://github.com/erlang/otp/security/advisories/GHSA-qw6r-qh9v-638v",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-295"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa)."
    },
    {
      "lang": "es",
      "value": "OTP es un conjunto de librerías de Erlang, que consta del sistema de ejecución de Erlang, una serie de componentes listos para usar escritos principalmente en Erlang y un conjunto de principios de diseño para programas de Erlang. Se introdujo una regresión en la aplicación SSL de OTP a partir de OTP-25.3.2.8, OTP-26.2 y OTP-27.0, lo que da como resultado que un servidor o cliente verifique al par cuando se presenta un uso incorrecto de la clave extendida (es decir, un servidor verificará a un cliente si tiene un uso de clave extendida de autenticación de servidor y viceversa)."
    }
  ],
  "lastModified": "2026-06-17T08:09:24.577",
  "sourceIdentifier": "security-advisories@github.com"
}