CVE-2024-53846

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-53846
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-53846.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-53846
Aliases
  • GHSA-qw6r-qh9v-638v
Downstream
Published
2024-12-05T17:02:59.370Z
Modified
2025-12-05T07:34:22.885823Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L CVSS Calculator
Summary
ssl fails to validate incorrect extened key usage
Details

OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/53xxx/CVE-2024-53846.json",
    "cwe_ids": [
        "CWE-295"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/erlang/otp

Affected ranges

Type
GIT
Repo
https://github.com/erlang/otp
Events
Introduced
c08f5acfb4e47933d8128d0b41b01487d0eb97a1
Last affected
d4469b4f5994941712ba24e238db06fd86f87b61
Database specific 
{
    "versions": [
        {
            "introduced": "25.3.2.8"
        },
        {
            "last_affected": "25.3.2.16"
        }
    ]
}
Type
GIT
Repo
https://github.com/erlang/otp
Events
Introduced
7fc0898502cb3370b7c6d523a7393cd101808493
Last affected
51548614b588c667a4230c17e2b187474dd70d63
Database specific 
{
    "versions": [
        {
            "introduced": "26.2"
        },
        {
            "last_affected": "26.2.5.6"
        }
    ]
}
Type
GIT
Repo
https://github.com/erlang/otp
Events
Introduced
601a012837ea0a5c8095bf24223132824177124d
Last affected
800613cca84970750658b294ddd7977843b3bc5d
Database specific 
{
    "versions": [
        {
            "introduced": "27.0"
        },
        {
            "last_affected": "27.1.3"
        }
    ]
}

Affected versions

OTP-24.*
OTP-24.3.4.15
OTP-24.3.4.16
OTP-25.*
OTP-25.3.2.10
OTP-25.3.2.11
OTP-25.3.2.12
OTP-25.3.2.13
OTP-25.3.2.14
OTP-25.3.2.15
OTP-25.3.2.16
OTP-25.3.2.8
OTP-25.3.2.9
OTP-26.*
OTP-26.2
OTP-26.2.1
OTP-26.2.2
OTP-26.2.3
OTP-26.2.4
OTP-26.2.5
OTP-26.2.5.1
OTP-26.2.5.2
OTP-26.2.5.3
OTP-26.2.5.4
OTP-26.2.5.5
OTP-26.2.5.6
OTP-27.*
OTP-27.0
OTP-27.0.1
OTP-27.1
OTP-27.1.1
OTP-27.1.2
OTP-27.1.3
Other
patch-base-26

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-53846.json"