Security update for erlang SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0974-1 Final 1 1 2018-04-18T06:29:08Z current 2018-04-18T06:29:08Z 2018-04-18T06:29:08Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for erlang This update for erlang fixes the following security issue: - CVE-2017-1000385: An erlang TLS server configured with cipher suites using RSA key exchange, may be vulnerable to an Adaptive Chosen Ciphertext attack (AKA Bleichenbacher attack) against RSA, which when exploited, may result in plaintext recovery of encrypted messages and/or a Man-in-the-middle (MiTM) attack, despite the attacker not having gained access to the server's private key itself. (bsc#1070960) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-7-2018-652,SUSE-Storage-4-2018-652 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180974-1/ Link for SUSE-SU-2018:0974-1 https://lists.suse.com/pipermail/sle-security-updates/2018-April/003896.html E-Mail link for SUSE-SU-2018:0974-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1070960 SUSE Bug 1070960 https://www.suse.com/security/cve/CVE-2017-1000385/ SUSE CVE CVE-2017-1000385 page SUSE Enterprise Storage 4 SUSE OpenStack Cloud 7 erlang-17.5.6-3.3.1 erlang-epmd-17.5.6-3.3.1 erlang-17.5.6-3.3.1 as a component of SUSE Enterprise Storage 4 erlang-epmd-17.5.6-3.3.1 as a component of SUSE Enterprise Storage 4 erlang-17.5.6-3.3.1 as a component of SUSE OpenStack Cloud 7 erlang-epmd-17.5.6-3.3.1 as a component of SUSE OpenStack Cloud 7 The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack). CVE-2017-1000385 SUSE Enterprise Storage 4:erlang-17.5.6-3.3.1 SUSE Enterprise Storage 4:erlang-epmd-17.5.6-3.3.1 SUSE OpenStack Cloud 7:erlang-17.5.6-3.3.1 SUSE OpenStack Cloud 7:erlang-epmd-17.5.6-3.3.1 moderate 6.1 AV:N/AC:H/Au:N/C:C/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180974-1/ https://www.suse.com/security/cve/CVE-2017-1000385.html CVE-2017-1000385 https://bugzilla.suse.com/1070960 SUSE Bug 1070960