CVE-2022-37026

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-37026
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37026.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-37026
Downstream
Related
Published
2022-09-21T00:00:00Z
Modified
2026-07-15T01:48:54.074942751Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37026.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/erlang/otp

Affected ranges

Type
GIT
Repo
https://github.com/erlang/otp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
8e9201679129a42c9a2a78940dae83a058be68f2
Introduced
583cba31eb09c14abd0b217fe7ac2e9a60425d51
Fixed
0251f542a2ef42ded2a146649d05ff9e7e457268
Introduced
4ed7957623e5ccbd420a09a506bd6bc9930fe93c
Fixed
ac0c9879c68b23278178a7afe738285b33ff1832
Database specific 
{
    "cpe": "cpe:2.3:a:erlang:erlang\\/otp:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "23.3.4.15"
        },
        {
            "introduced": "24.0"
        },
        {
            "fixed": "24.3.4.2"
        },
        {
            "introduced": "25.0"
        },
        {
            "fixed": "25.0.2"
        }
    ]
}

Affected versions

OTP-17.*
OTP-17.0
OTP-18.*
OTP-18.0
OTP-18.0-rc1
OTP-19.*
OTP-19.0
OTP-19.0-rc1
OTP-19.0-rc2
OTP-20.*
OTP-20.0
OTP-20.0-rc1
OTP-20.0-rc2
OTP-21.*
OTP-21.0
OTP-21.0-rc1
OTP-21.0-rc2
OTP-22.*
OTP-22.0
OTP-22.0-rc1
OTP-22.0-rc2
OTP-22.0-rc3
OTP-23.*
OTP-23.0
OTP-23.0-rc1
OTP-23.0-rc2
OTP-23.0-rc3
OTP-23.1
OTP-23.2
OTP-23.3
OTP-23.3.1
OTP-23.3.2
OTP-23.3.3
OTP-23.3.4
OTP-23.3.4.1
OTP-23.3.4.10
OTP-23.3.4.11
OTP-23.3.4.12
OTP-23.3.4.13
OTP-23.3.4.14
OTP-23.3.4.2
OTP-23.3.4.3
OTP-23.3.4.4
OTP-23.3.4.5
OTP-23.3.4.6
OTP-23.3.4.7
OTP-23.3.4.8
OTP-23.3.4.9
OTP-24.*
OTP-24.0
OTP-24.1
OTP-24.2
OTP-24.3
OTP-24.3.1
OTP-24.3.2
OTP-24.3.3
OTP-24.3.4
OTP-24.3.4.1
OTP-25.*
OTP-25.0
OTP-25.0.1
OTP_17.*
OTP_17.0-rc1
OTP_17.0-rc2
Other
OTP_R13B03
OTP_R13B04
OTP_R14A
OTP_R14B
OTP_R14B01
OTP_R14B02
OTP_R14B03
OTP_R15A
OTP_R15B
OTP_R16A_RELEASE_CANDIDATE
OTP_R16B
patch-base-24

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-37026.json"