CVE request: Erlang POODLE TLS vulnerability

[Hanno Böck <hanno () hboeck de>]

Hi,

From the release notes of Erlang 18.0-rc1:
http://www.erlang.org/news/85
"ssl: Remove default support for SSL-3.0 and added padding check for
TLS-1.0 due to the Poodle vulnerability."

This indicates that Erlang was vulnerable to the TLS-variant of the
poodle vulnerability due to missing padding checks (see [1]).

While disabling old protocols is maybe not something covered by CVEs,
this clearly is an implementation error and thus should be considered a
vuln.


[1] https://www.imperialviolet.org/2014/12/08/poodleagain.html

cu,
-- 
Hanno Böck
http://hboeck.de/

mail/jabber: hanno () hboeck de
GPG: BBB51E42

Attachment: _bin
Description: OpenPGP digital signature