CVE-2015-2774 Weak cryptography in n/a
Man-in-the-middle attackers can decrypt TLS traffic via a padding oracle attack due to improper CBC padding checks in Erlang/OTP.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-2774?
CVE-2015-2774 is a medium-severity vulnerability in Opensuse Opensuse, published on 7 Apr 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Erlang/OTP before 18.0-rc1 does not properly check CBC padding bytes when terminating connections, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, a variant of CVE-2014-3566 (aka POODLE).
Weakness: CWE-200
Which versions are affected by CVE-2015-2774?
It affects 3 products.
Products include Erlang Erlang\/Otp, Opensuse Opensuse, Oracle Solaris.
How do I fix CVE-2015-2774?
Upgrade to a fixed version.
Is CVE-2015-2774 being exploited?
There is no known exploitation of CVE-2015-2774 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Opensuse
- CVE-2022-37026 Auth bypass in n/a
- CVE-2016-10253 Memory corruption in n/a
- CVE-2026-55953 TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
- CVE-2026-49759 Stack buffer overflow in SCTP error cause parsing in inet_drv allows remote VM crash
- CVE-2026-58227 TLS/DTLS denial of service via unbounded recursion on cross-signed peer certificate chain
Sources
Also known as DEBIAN-CVE-2015-2774, GHSA-x7g5-r7mw-4gvx, MGASA-2015-0192, UBUNTU-CVE-2015-2774.