DEBIAN-CVE-2024-53846

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2024-53846
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-53846.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2024-53846
Upstream
Published
2024-12-05T17:15:14Z
Modified
2025-09-25T04:21:09.455767Z
Summary
[none]
Details

OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).

References

Affected packages

Debian:13 / erlang

Package

Name
erlang
Purl
pkg:deb/debian/erlang?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:27.2+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / erlang

Package

Name
erlang
Purl
pkg:deb/debian/erlang?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:27.2+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}