{"id":"CVE-2015-2774","aliases":["DEBIAN-CVE-2015-2774","EUVD-2015-2864","GHSA-x7g5-r7mw-4gvx","MGASA-2015-0192","UBUNTU-CVE-2015-2774","USN-3571-1"],"status":"published","title":"Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections...","description":"Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01899,"percentile":0.79793,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2015-05-05T16:38:17Z","modified":"2026-09-09T07:00:48Z","fixes":[{"ecosystem":"Debian:12","package":"erlang","fixed_in":["1:17.3-dfsg-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"erlang","fixed_in":["1:17.3-dfsg-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"erlang","fixed_in":["1:17.3-dfsg-4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"erlang","fixed_in":["R16B02-2.2.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"erlang","fixed_in":["1:16.b.3-dfsg-1ubuntu2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.3-dfsg-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.3-dfsg-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:17.3-dfsg-4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"R16B02-2.2.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.b.3-dfsg-1ubuntu2.2"}]}],"versions":["1:16.b.1-dfsg-4ubuntu1","1:16.b.2-dfsg-1ubuntu1","1:16.b.2-dfsg-2ubuntu1","1:16.b.3-dfsg-1ubuntu1","1:16.b.3-dfsg-1ubuntu2","1:16.b.3-dfsg-1ubuntu2.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.b.3-dfsg-1ubuntu2.2"}]}],"versions":["1:16.b.1-dfsg-4ubuntu1","1:16.b.2-dfsg-1ubuntu1","1:16.b.2-dfsg-2ubuntu1","1:16.b.3-dfsg-1ubuntu1","1:16.b.3-dfsg-1ubuntu2","1:16.b.3-dfsg-1ubuntu2.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"erlang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:18.3-dfsg-1ubuntu3.1"}]}],"versions":["1:18.0-dfsg-1ubuntu1","1:18.0-dfsg-1ubuntu2","1:18.2-dfsg-2ubuntu1","1:18.3-dfsg-1ubuntu1","1:18.3-dfsg-1ubuntu2","1:18.3-dfsg-1ubuntu3"],"bundled":4}],"products":[{"vendor":"erlang","product":"erlang\\/otp"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"oracle","product":"solaris"}],"references":[{"url":"https://usn.ubuntu.com/3571-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"https://web.archive.org/web/20150905124006/http://www.erlang.org/news/85","tags":["x_refsource_CONFIRM","x_transferred","Release Notes","advisory"]},{"url":"https://www.imperialviolet.org/2014/12/08/poodleagain.html","tags":["x_refsource_MISC","x_transferred","Technical Description","article"]},{"url":"http://www.securityfocus.com/bid/73398","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-02/msg00124.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://openwall.com/lists/oss-security/2015/03/27/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://openwall.com/lists/oss-security/2015/03/27/6","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2774"},{"url":"https://usn.ubuntu.com/3571-1"},{"url":"https://github.com/advisories/GHSA-x7g5-r7mw-4gvx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-2774","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0192.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15580","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-2774","tags":["report"]},{"url":"http://www.erlang.org/news/85","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3571-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-2774","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-1693","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-10253","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000385","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-2774","description":"Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).","status":"published","published":"2016-04-07T21:00:00Z","modified":"2024-08-06T05:24:39.027Z","updated_at":"2026-11-02T14:35:41.621934Z"}],"euvd":[{"id":"EUVD-2015-2864","description":"Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).","status":"published","published":"2016-04-07T21:00:00Z","modified":"2024-08-06T05:24:39Z","updated_at":"2026-11-03T02:22:10.564423Z"}],"ghsa":[{"id":"GHSA-x7g5-r7mw-4gvx","title":"Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections...","description":"Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).","status":"published","published":"2022-05-14T02:06:53Z","modified":"2025-04-12T12:59:15Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:01:26.389958Z"}],"nvd":[{"id":"CVE-2015-2774","description":"Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).","status":"published","published":"2016-04-07T21:59:00.12Z","modified":"2026-06-17T00:24:43.757Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"CVE-2015-2774","description":"Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).","status":"published","published":"2016-04-07T21:59:00Z","modified":"2026-04-16T06:25:37.866588157Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-2774","description":"Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).","status":"published","published":"2016-04-07T21:59:00.12Z","modified":"2026-09-09T07:00:48.124788717Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"UBUNTU-CVE-2015-2774","description":"Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).","status":"published","published":"2016-04-07T00:00:00Z","modified":"2026-04-22T10:06:27.992558Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"MGASA-2015-0192","title":"Updated erlang packages fix CVE-2015-2774","description":"Updated erlang packages fix security vulnerability:\n\nErlang's TLS-1.0 implementation failed to check padding bytes, leaving it\nvulnerable to an issue similar to POODLE (CVE-2015-2774).\n","status":"published","published":"2015-05-05T16:38:17Z","modified":"2026-04-16T06:25:56.680089515Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"USN-3571-1","title":"erlang vulnerabilities","description":"It was discovered that the Erlang FTP module incorrectly handled certain\nCRLF sequences. A remote attacker could possibly use this issue to inject\narbitrary FTP commands. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2014-1693)\n\nIt was discovered that Erlang incorrectly checked CBC padding bytes. A\nremote attacker could possibly use this issue to perform a padding oracle\nattack and decrypt traffic. This issue only affected Ubuntu 14.04 LTS.\n(CVE-2015-2774)\n\nIt was discovered that Erlang incorrectly handled certain regular\nexpressions. A remote attacker could possibly use this issue to cause\nErlang to crash, resulting in a denial of service, or execute arbitrary\ncode. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-10253)\n\nHanno Böck, Juraj Somorovsky and Craig Young discovered that the Erlang\notp TLS server incorrectly handled error reporting. A remote attacker could\npossibly use this issue to perform a variation of the Bleichenbacher attack\nand decrypt traffic or sign messages. (CVE-2017-1000385)\n","status":"published","published":"2018-02-14T14:54:29Z","modified":"2026-04-22T09:43:55.581119Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}