yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP virtual machine with a version less than 21.0.
References
Link | Resource |
---|---|
https://github.com/erlyaws/yaws/blob/c0fd79f17d52628fcec527da7fa3e788c283c445/src/yaws_config.erl#L2068-L2075 | Exploit Third Party Advisory |
https://github.com/erlyaws/yaws/issues/402 | Issue Tracking Third Party Advisory |
https://github.com/erlyaws/yaws/releases | Release Notes Third Party Advisory |
https://medium.com/%40charlielabs101/cve-2020-12872-df315411aa70 | |
https://sweet32.info/ | Third Party Advisory |
Configurations
History
07 Nov 2023, 03:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Information
Published : 2020-05-15 19:15
Updated : 2024-02-28 17:47
NVD link : CVE-2020-12872
Mitre link : CVE-2020-12872
CVE.ORG link : CVE-2020-12872
JSON object : View
Products Affected
yaws
- yaws
CWE
CWE-326
Inadequate Encryption Strength