{"id":"CVE-2014-1693","aliases":["DEBIAN-CVE-2014-1693","EUVD-2014-1767","GHSA-q3fq-w858-v26f","MGASA-2014-0553","UBUNTU-CVE-2014-1693","USN-3571-1"],"status":"published","title":"Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context...","description":"Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, or (18) append_bin command.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02193,"percentile":0.82564,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2014-12-08T00:00:00Z","modified":"2026-10-23T15:47:24Z","fixes":[{"ecosystem":"Debian:12","package":"erlang","fixed_in":["1:16.b.3.1-dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"erlang","fixed_in":["1:16.b.3.1-dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"erlang","fixed_in":["1:16.b.3.1-dfsg-3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"erlang","fixed_in":["R16B02-2.1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"erlang","fixed_in":["1:16.b.3-dfsg-1ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.b.3.1-dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.b.3.1-dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.b.3.1-dfsg-3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"R16B02-2.1.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.b.3-dfsg-1ubuntu2.2"}]}],"versions":["1:16.b.1-dfsg-4ubuntu1","1:16.b.2-dfsg-1ubuntu1","1:16.b.2-dfsg-2ubuntu1","1:16.b.3-dfsg-1ubuntu1","1:16.b.3-dfsg-1ubuntu2","1:16.b.3-dfsg-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.b.3-dfsg-1ubuntu2.2"}]}],"versions":["1:16.b.1-dfsg-4ubuntu1","1:16.b.2-dfsg-1ubuntu1","1:16.b.2-dfsg-2ubuntu1","1:16.b.3-dfsg-1ubuntu1","1:16.b.3-dfsg-1ubuntu2","1:16.b.3-dfsg-1ubuntu2.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.3-dfsg-1ubuntu3.1"}]}],"versions":["1:18.0-dfsg-1ubuntu1","1:18.0-dfsg-1ubuntu2","1:18.2-dfsg-2ubuntu1","1:18.3-dfsg-1ubuntu1","1:18.3-dfsg-1ubuntu2","1:18.3-dfsg-1ubuntu3"],"bundled":4}],"products":[{"vendor":"erlang","product":"erlang\\/otp"}],"references":[{"url":"https://usn.ubuntu.com/3571-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1059331","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145017.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:174","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://seclists.org/oss-sec/2014/q1/163","tags":["mailing-list","x_refsource_MLIST","x_transferred","Exploit","evidence"]},{"url":"http://advisories.mageia.org/MGASA-2014-0553.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1693"},{"url":"https://usn.ubuntu.com/3571-1"},{"url":"https://github.com/advisories/GHSA-q3fq-w858-v26f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-1693","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0553.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14715","tags":["report"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-December/145017.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-December/146184.html","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-1693","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/01/29/3","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/01/29","tags":["report"]},{"url":"http://erlang.org/pipermail/erlang-bugs/2014-January/003998.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3571-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-1693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-2774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000385","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-1693","description":"Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, or (18) append_bin command.","status":"published","published":"2014-12-08T11:00:00Z","modified":"2024-08-06T09:50:10.831Z","updated_at":"2026-11-02T14:33:46.310517Z"}],"euvd":[{"id":"EUVD-2014-1767","description":"Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, or (18) append_bin command.","status":"published","published":"2014-12-08T11:00:00Z","modified":"2024-08-06T09:50:10Z","updated_at":"2026-11-03T01:57:17.345507Z"}],"ghsa":[{"id":"GHSA-q3fq-w858-v26f","title":"Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context...","description":"Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, or (18) append_bin command.","status":"published","published":"2022-05-14T03:38:05Z","modified":"2025-04-12T12:43:42Z","updated_at":"2026-11-02T15:01:19.873405Z"}],"nvd":[{"id":"CVE-2014-1693","description":"Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, or (18) append_bin command.","status":"published","published":"2014-12-08T11:59:01.86Z","modified":"2026-06-17T00:05:23.33Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:02:57.680258Z"}],"osv":[{"id":"CVE-2014-1693","description":"Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, or (18) append_bin command.","status":"published","published":"2014-12-08T11:59:01Z","modified":"2026-04-16T06:23:14.572893273Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-1693","description":"Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, or (18) append_bin command.","status":"published","published":"2014-12-08T11:59:01.86Z","modified":"2026-10-23T15:47:24.671679075Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"MGASA-2014-0553","title":"Updated erlang packages fix security vulnerabilities","description":"Updated erlang packages fixes security vulnerability:\n\nAn FTP command injection flaw was found in Erlang's FTP module. Several\nfunctions in the FTP module do not properly sanitize the input before passing\nit into a control socket. A local attacker can use this flaw to execute\narbitrary FTP commands on a system that uses this module (CVE-2014-1693).\n\nThis update also disables SSLv3 by default to mitigate the POODLE issue.\n","status":"published","published":"2014-12-26T17:04:58Z","modified":"2026-04-16T06:25:39.244441525Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2014-1693","description":"Multiple CRLF injection vulnerabilities in the FTP module in Erlang/OTP R15B03 allow context-dependent attackers to inject arbitrary FTP commands via CRLF sequences in the (1) user, (2) account, (3) cd, (4) ls, (5) nlist, (6) rename, (7) delete, (8) mkdir, (9) rmdir, (10) recv, (11) recv_bin, (12) recv_chunk_start, (13) send, (14) send_bin, (15) send_chunk_start, (16) append_chunk_start, (17) append, or (18) append_bin command.","status":"published","published":"2014-12-08T00:00:00Z","modified":"2026-04-22T09:35:50.308872Z","updated_at":"2026-11-02T15:54:07.855521Z"},{"id":"USN-3571-1","title":"erlang vulnerabilities","description":"It was discovered that the Erlang FTP module incorrectly handled certain\nCRLF sequences. A remote attacker could possibly use this issue to inject\narbitrary FTP commands. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2014-1693)\n\nIt was discovered that Erlang incorrectly checked CBC padding bytes. A\nremote attacker could possibly use this issue to perform a padding oracle\nattack and decrypt traffic. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2015-2774)\n\nIt was discovered that Erlang incorrectly handled certain regular\nexpressions. A remote attacker could possibly use this issue to cause\nErlang to crash, resulting in a denial of service, or execute arbitrary\ncode. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-10253)\n\nHanno Böck, Juraj Somorovsky and Craig Young discovered that the Erlang\notp TLS server incorrectly handled error reporting. A remote attacker could\npossibly use this issue to perform a variation of the Bleichenbacher attack\nand decrypt traffic or sign messages. (CVE-2017-1000385)\n","status":"published","published":"2018-02-14T14:54:29Z","modified":"2026-04-22T09:43:55.581119Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}