Security update for erlang SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2016:0523-1 Final 1 1 2016-02-20T08:38:00Z current 2016-02-20T08:38:00Z 2016-02-20T08:38:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for erlang This update for erlang fixes the following issues: - CVE-2015-2774: Erlang/OTP was vulnerable to Poodle in its TLS-1.0 implementation - removed default support for SSL 3.0 and added padding check for TLS 1.0 (boo#924915) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) http://lists.opensuse.org/opensuse-updates/2016-02/msg00124.html E-Mail link for openSUSE-SU-2016:0523-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE 13.2 erlang-17.1-3.3.1 erlang-debugger-17.1-3.3.1 erlang-debugger-src-17.1-3.3.1 erlang-debuginfo-17.1-3.3.1 erlang-debugsource-17.1-3.3.1 erlang-dialyzer-17.1-3.3.1 erlang-dialyzer-debuginfo-17.1-3.3.1 erlang-dialyzer-src-17.1-3.3.1 erlang-doc-17.1-3.3.1 erlang-epmd-17.1-3.3.1 erlang-epmd-debuginfo-17.1-3.3.1 erlang-et-17.1-3.3.1 erlang-et-src-17.1-3.3.1 erlang-gs-17.1-3.3.1 erlang-gs-src-17.1-3.3.1 erlang-jinterface-17.1-3.3.1 erlang-jinterface-src-17.1-3.3.1 erlang-observer-17.1-3.3.1 erlang-observer-src-17.1-3.3.1 erlang-reltool-17.1-3.3.1 erlang-reltool-src-17.1-3.3.1 erlang-src-17.1-3.3.1 erlang-wx-17.1-3.3.1 erlang-wx-debuginfo-17.1-3.3.1 erlang-wx-src-17.1-3.3.1 erlang-17.1-3.3.1 as a component of openSUSE 13.2 erlang-debugger-17.1-3.3.1 as a component of openSUSE 13.2 erlang-debugger-src-17.1-3.3.1 as a component of openSUSE 13.2 erlang-debuginfo-17.1-3.3.1 as a component of openSUSE 13.2 erlang-debugsource-17.1-3.3.1 as a component of openSUSE 13.2 erlang-dialyzer-17.1-3.3.1 as a component of openSUSE 13.2 erlang-dialyzer-debuginfo-17.1-3.3.1 as a component of openSUSE 13.2 erlang-dialyzer-src-17.1-3.3.1 as a component of openSUSE 13.2 erlang-doc-17.1-3.3.1 as a component of openSUSE 13.2 erlang-epmd-17.1-3.3.1 as a component of openSUSE 13.2 erlang-epmd-debuginfo-17.1-3.3.1 as a component of openSUSE 13.2 erlang-et-17.1-3.3.1 as a component of openSUSE 13.2 erlang-et-src-17.1-3.3.1 as a component of openSUSE 13.2 erlang-gs-17.1-3.3.1 as a component of openSUSE 13.2 erlang-gs-src-17.1-3.3.1 as a component of openSUSE 13.2 erlang-jinterface-17.1-3.3.1 as a component of openSUSE 13.2 erlang-jinterface-src-17.1-3.3.1 as a component of openSUSE 13.2 erlang-observer-17.1-3.3.1 as a component of openSUSE 13.2 erlang-observer-src-17.1-3.3.1 as a component of openSUSE 13.2 erlang-reltool-17.1-3.3.1 as a component of openSUSE 13.2 erlang-reltool-src-17.1-3.3.1 as a component of openSUSE 13.2 erlang-src-17.1-3.3.1 as a component of openSUSE 13.2 erlang-wx-17.1-3.3.1 as a component of openSUSE 13.2 erlang-wx-debuginfo-17.1-3.3.1 as a component of openSUSE 13.2 erlang-wx-src-17.1-3.3.1 as a component of openSUSE 13.2 Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE). CVE-2015-2774 openSUSE 13.2:erlang-17.1-3.3.1 openSUSE 13.2:erlang-debugger-17.1-3.3.1 openSUSE 13.2:erlang-debugger-src-17.1-3.3.1 openSUSE 13.2:erlang-debuginfo-17.1-3.3.1 openSUSE 13.2:erlang-debugsource-17.1-3.3.1 openSUSE 13.2:erlang-dialyzer-17.1-3.3.1 openSUSE 13.2:erlang-dialyzer-debuginfo-17.1-3.3.1 openSUSE 13.2:erlang-dialyzer-src-17.1-3.3.1 openSUSE 13.2:erlang-doc-17.1-3.3.1 openSUSE 13.2:erlang-epmd-17.1-3.3.1 openSUSE 13.2:erlang-epmd-debuginfo-17.1-3.3.1 openSUSE 13.2:erlang-et-17.1-3.3.1 openSUSE 13.2:erlang-et-src-17.1-3.3.1 openSUSE 13.2:erlang-gs-17.1-3.3.1 openSUSE 13.2:erlang-gs-src-17.1-3.3.1 openSUSE 13.2:erlang-jinterface-17.1-3.3.1 openSUSE 13.2:erlang-jinterface-src-17.1-3.3.1 openSUSE 13.2:erlang-observer-17.1-3.3.1 openSUSE 13.2:erlang-observer-src-17.1-3.3.1 openSUSE 13.2:erlang-reltool-17.1-3.3.1 openSUSE 13.2:erlang-reltool-src-17.1-3.3.1 openSUSE 13.2:erlang-src-17.1-3.3.1 openSUSE 13.2:erlang-wx-17.1-3.3.1 openSUSE 13.2:erlang-wx-debuginfo-17.1-3.3.1 openSUSE 13.2:erlang-wx-src-17.1-3.3.1 moderate Please Install the update. http://lists.opensuse.org/opensuse-updates/2016-02/msg00124.html https://www.suse.com/security/cve/CVE-2015-2774.html CVE-2015-2774 https://bugzilla.suse.com/924915 SUSE Bug 924915