CVE-2024-53846 ssl fails to validate incorrect extened key usage
Attackers can bypass SSL certificate validation by presenting incorrect extended key usage, allowing unauthorized connections in Erlang OTP applications.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-53846?
CVE-2024-53846 is a medium-severity vulnerability in erlang otp, published on 5 Dec 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).
Weakness: CWE-295
Which versions are affected by CVE-2024-53846?
How do I fix CVE-2024-53846?
Upgrade to a fixed version.
Is CVE-2024-53846 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-53846 exists.
Sources
Also known as AZL-54051, DEBIAN-CVE-2024-53846, GHSA-qw6r-qh9v-638v, UBUNTU-CVE-2024-53846, USN-7961-1.