An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certification Authority.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an
    invalid X.509 certificate chain to a trusted root Certification Authority. (CVE-2020-35733)

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-06cbd73fba advisory.

  - An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an     invalid X.509 certificate chain to a trusted root Certification Authority. (CVE-2020-35733)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
427771	Alpine: erlang26: security update to 23.2.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
427771	Alpine: erlang26: security update to 23.2.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
427125	Alpine: erlang: security update to 23.2.5-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
427125	Alpine: erlang: security update to 23.2.5-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
145559	Fedora 33 : erlang (2021-06cbd73fba)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-35733

high

Tenable Plugins

high

high

high

high

high