CVE-2022-37026

一、漏洞信息
 漏洞编号：[CVE-2022-37026](https://nvd.nist.gov/vuln/detail/CVE-2022-37026)
 漏洞归属组件：[erlang](https://gitee.com/src-openeuler/erlang)
 漏洞归属的版本：21.3.3,23.3.4.9,25.3.2.6
 CVSS V3.0分值：
  BaseScore：9.8 Critical
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
 漏洞简述：
  In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.
 漏洞公开时间：2022-09-21 22:15:11
 漏洞创建时间：2022-10-18 08:33:32
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2022-37026
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| cve.mitre.org | https://erlangforums.com/c/erlang-news-announcements/91 |  |
| cve.mitre.org | https://erlangforums.com/t/otp-25-1-released/1854 |  |
| cve.mitre.org | https://github.com/erlang/otp/compare/OTP-23.3.4.14...OTP-23.3.4.15 |  |
| cve.mitre.org | https://lists.debian.org/debian-lts-announce/2023/07/msg00012.html |  |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2141802 | https://bugzilla.suse.com/show_bug.cgi?id=1205318 |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-37026 | https://bugzilla.suse.com/show_bug.cgi?id=1205318 |
| suse_bugzilla | https://www.cve.org/CVERecord?id=CVE-2022-37026 | https://bugzilla.suse.com/show_bug.cgi?id=1205318 |
| suse_bugzilla | https://github.com/erlang/otp/compare/OTP-23.3.4.14...OTP-23.3.4.15 | https://bugzilla.suse.com/show_bug.cgi?id=1205318 |
| suse_bugzilla | https://erlangforums.com/t/otp-25-1-released/1854 | https://bugzilla.suse.com/show_bug.cgi?id=1205318 |
| suse_bugzilla | https://erlangforums.com/c/erlang-news-announcements/91 | https://bugzilla.suse.com/show_bug.cgi?id=1205318 |
| redhat_bugzilla | https://access.redhat.com/errata/RHSA-2022:8857 | https://bugzilla.redhat.com/show_bug.cgi?id=2141802 |
| redhat_bugzilla | https://access.redhat.com/security/cve/cve-2022-37026 | https://bugzilla.redhat.com/show_bug.cgi?id=2141802 |
| ubuntu | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37026 | https://ubuntu.com/security/CVE-2022-37026 |
| ubuntu | https://github.com/erlang/otp/compare/OTP-23.3.4.14...OTP-23.3.4.15 | https://ubuntu.com/security/CVE-2022-37026 |
| ubuntu | https://erlangforums.com/c/erlang-news-announcements/91 | https://ubuntu.com/security/CVE-2022-37026 |
| ubuntu | https://erlangforums.com/t/otp-25-1-released/1854 | https://ubuntu.com/security/CVE-2022-37026 |
| ubuntu | https://nvd.nist.gov/vuln/detail/CVE-2022-37026 | https://ubuntu.com/security/CVE-2022-37026 |
| ubuntu | https://launchpad.net/bugs/cve/CVE-2022-37026 | https://ubuntu.com/security/CVE-2022-37026 |
| ubuntu | https://security-tracker.debian.org/tracker/CVE-2022-37026 | https://ubuntu.com/security/CVE-2022-37026 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2022-37026 |
| anolis |  | https://anas.openanolis.cn/cves/detail/CVE-2022-37026 |
| cve_search |  | https://github.com/erlang/otp/compare/OTP-23.3.4.14...OTP-23.3.4.15 |
| cve_search |  | https://erlangforums.com/c/erlang-news-announcements/91 |
| cve_search |  | https://erlangforums.com/t/otp-25-1-released/1854 |
| cve_search |  | https://lists.debian.org/debian-lts-announce/2023/07/msg00012.html |
| mageia |  | http://advisories.mageia.org/MGASA-2022-0450.html |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  其它
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://erlangforums.com/c/erlang-news-announcements/91 |  | nvd |
|  |  | https://erlangforums.com/t/otp-25-1-released/1854 |  | nvd |
|  |  | https://github.com/erlang/otp/compare/OTP-23.3.4.14...OTP-23.3.4.15 |  | nvd |
| erlang |  | https://github.com/erlang/otp/commit/cd5024867e7b7d3a6e94194af9e01e1fb77e36c9%20(23.x) |  | ubuntu |
| erlang |  | https://github.com/erlang/otp/commit/6a1baa36e4e6c1b682e8b48e0c141602e0b8e6e5%20(23.x) |  | ubuntu |
| erlang |  | https://github.com/erlang/otp/commit/254f2728902bc7e80a67726ebbc1a0b3ab7742eb%20(24.x) |  | ubuntu |
| erlang |  | https://github.com/erlang/otp/commit/33e7570e075e0b84efef91b2f307fcf938517b1c%20(24.x) |  | ubuntu |
|  |  | https://github.com/erlang/otp/commit/cd5024867e7b7d3a6e94194af9e01e1fb77e36c9 |  | debian |
|  |  | https://github.com/erlang/otp/commit/254f2728902bc7e80a67726ebbc1a0b3ab7742eb |  | debian |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.
 openEuler评分：
  9.8
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS-SP4(21.3.3):受影响
2.openEuler-22.03-LTS-SP3(23.3.4.9):受影响
3.master(26.2.5.6):不受影响
4.openEuler-22.03-LTS-SP4(23.3.4.9):不受影响
5.openEuler-24.03-LTS(25.3.2.6):不受影响
6.openEuler-24.03-LTS-Next(25.3.2.6):不受影响
7.openEuler-24.03-LTS-SP1(25.3.2.6):不受影响

修复是否涉及abi变化(是/否)：
  1.master(26.2.5.6):否
2.openEuler-20.03-LTS-SP4(21.3.3):否
3.openEuler-22.03-LTS-SP3(23.3.4.9):否
4.openEuler-22.03-LTS-SP4(23.3.4.9):否
5.openEuler-24.03-LTS(25.3.2.6):否
6.openEuler-24.03-LTS-Next(25.3.2.6):否
7.openEuler-24.03-LTS-SP1(25.3.2.6):否

原因说明：
  1.openEuler-22.03-LTS-SP3(23.3.4.9):正常修复
2.openEuler-20.03-LTS-SP4(21.3.3):暂不修复-待升级版本修复
3.master(26.2.5.6):不受影响-漏洞代码不能被攻击者触发
4.openEuler-22.03-LTS-SP4(23.3.4.9):不受影响-漏洞代码不能被攻击者触发
5.openEuler-24.03-LTS(25.3.2.6):不受影响-漏洞代码不能被攻击者触发
6.openEuler-24.03-LTS-Next(25.3.2.6):不受影响-漏洞代码不能被攻击者触发
7.openEuler-24.03-LTS-SP1(25.3.2.6):不受影响-漏洞代码不能被攻击者触发

src-openEuler/erlang
Closed

Content Risk Flag

Comments (23)

src-openEuler/erlangClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2022-37026

Comments (23)

Search

src-openEuler/erlang
Closed