Bugzilla – Bug 1205318
VUL-0: CVE-2022-37026: erlang: erlang/otp: Client Authentication Bypass
Last modified: 2024-05-22 02:50:37 UTC
rh#2141802 In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS. References: https://bugzilla.redhat.com/show_bug.cgi?id=2141802 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-37026 https://www.cve.org/CVERecord?id=CVE-2022-37026 https://github.com/erlang/otp/compare/OTP-23.3.4.14...OTP-23.3.4.15 https://erlangforums.com/t/otp-25-1-released/1854 https://erlangforums.com/c/erlang-news-announcements/91
#proj-emu-erlang has been setup on slack to discuss the backporting of this patch. I have also asked around engineering to see if we have any erlang experts around.
* SUSE:SLE-15-SP2:Update ssr#284868 * SUSE:SLE-15-SP3:Update ssr#284871 Thanks to Simon Lees for doing the really hard work to make it work.
Do we know of any usecases in the CloudX products? the patch is significantly harder to backport and it would be great if I could do some more testing.
SUSE-SU-2022:4215-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1205318 CVE References: CVE-2022-37026 JIRA References: Sources used: openSUSE Leap 15.4 (src): erlang-22.3-150300.3.3.1 openSUSE Leap 15.3 (src): erlang-22.3-150300.3.3.1 SUSE Linux Enterprise Module for Server Applications 15-SP4 (src): erlang-22.3-150300.3.3.1 SUSE Linux Enterprise Module for Server Applications 15-SP3 (src): erlang-22.3-150300.3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:4222-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1205318 CVE References: CVE-2022-37026 JIRA References: Sources used: SUSE Manager Server 4.1 (src): erlang-22.2.7-150200.3.3.1 SUSE Manager Retail Branch Server 4.1 (src): erlang-22.2.7-150200.3.3.1 SUSE Manager Proxy 4.1 (src): erlang-22.2.7-150200.3.3.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): erlang-22.2.7-150200.3.3.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): erlang-22.2.7-150200.3.3.1 SUSE Linux Enterprise Server 15-SP2-BCL (src): erlang-22.2.7-150200.3.3.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): erlang-22.2.7-150200.3.3.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src): erlang-22.2.7-150200.3.3.1 SUSE Enterprise Storage 7 (src): erlang-22.2.7-150200.3.3.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Adding @Keith Berger to provide insight into SOC customers impact.
I now have the test suite somewhat running and it seems likely that there is some form of regression introduced with this fix. I will have a look in more detail tomorrow.
https://github.com/erlang/otp/commit/cd5024867e7b7d3a6e94194af9e01e1fb77e36c9.patch is the commit with the actual fix.
SUSE-SU-2023:3409-1: An update that solves one vulnerability and has one fix can now be installed. Category: security (important) Bug References: 1205318, 1207113 CVE References: CVE-2022-37026 Sources used: SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (src): erlang-22.2.7-150200.3.8.1 SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (src): erlang-22.2.7-150200.3.8.1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 (src): erlang-22.2.7-150200.3.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:3401-1: An update that solves one vulnerability and has one fix can now be installed. Category: security (important) Bug References: 1205318, 1207113 CVE References: CVE-2022-37026 Sources used: openSUSE Leap 15.4 (src): erlang-22.3-150300.3.8.1 openSUSE Leap 15.5 (src): erlang-22.3-150300.3.8.1 Server Applications Module 15-SP4 (src): erlang-22.3-150300.3.8.1 Server Applications Module 15-SP5 (src): erlang-22.3-150300.3.8.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): erlang-22.3-150300.3.8.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): erlang-22.3-150300.3.8.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): erlang-22.3-150300.3.8.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): erlang-22.3-150300.3.8.1 SUSE Manager Proxy 4.2 (src): erlang-22.3-150300.3.8.1 SUSE Manager Retail Branch Server 4.2 (src): erlang-22.3-150300.3.8.1 SUSE Manager Server 4.2 (src): erlang-22.3-150300.3.8.1 SUSE Enterprise Storage 7.1 (src): erlang-22.3-150300.3.8.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2023:4109-1: An update that solves one vulnerability and contains one feature can now be installed. Category: security (critical) Bug References: 1205318 CVE References: CVE-2022-37026 Jira References: PED-6209 Sources used: Server Applications Module 15-SP4 (src): erlang-23.3.4.19-150300.3.11.1 Server Applications Module 15-SP5 (src): erlang-23.3.4.19-150300.3.11.1 SUSE Linux Enterprise High Performance Computing ESPOS 15 SP3 (src): erlang-23.3.4.19-150300.3.11.1 SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (src): erlang-23.3.4.19-150300.3.11.1 SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (src): erlang-23.3.4.19-150300.3.11.1 SUSE Linux Enterprise Server for SAP Applications 15 SP3 (src): erlang-23.3.4.19-150300.3.11.1 SUSE Manager Proxy 4.2 (src): erlang-23.3.4.19-150300.3.11.1 SUSE Manager Retail Branch Server 4.2 (src): erlang-23.3.4.19-150300.3.11.1 SUSE Manager Server 4.2 (src): erlang-23.3.4.19-150300.3.11.1 SUSE Enterprise Storage 7.1 (src): erlang-23.3.4.19-150300.3.11.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.