Bug 1205318 - (CVE-2022-37026) VUL-0: CVE-2022-37026: erlang: erlang/otp: Client Authentication Bypass
(CVE-2022-37026)
VUL-0: CVE-2022-37026: erlang: erlang/otp: Client Authentication Bypass
Status: IN_PROGRESS
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Critical
: ---
Assigned To: E-Mail List
Security Team bot
https://smash.suse.de/issue/343153/
CVSSv3.1:SUSE:CVE-2022-37026:9.4:(AV:...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2022-11-11 08:29 UTC by Stoyan Manolov
Modified: 2022-11-30 11:37 UTC (History)
8 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Stoyan Manolov 2022-11-11 08:29:22 UTC
rh#2141802

In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification situations for SSL, TLS, and DTLS.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=2141802
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-37026
https://www.cve.org/CVERecord?id=CVE-2022-37026
https://github.com/erlang/otp/compare/OTP-23.3.4.14...OTP-23.3.4.15
https://erlangforums.com/t/otp-25-1-released/1854
https://erlangforums.com/c/erlang-news-announcements/91
Comment 5 Simon Lees 2022-11-22 06:52:51 UTC
#proj-emu-erlang has been setup on slack to discuss the backporting of this patch. I have also asked around engineering to see if we have any erlang experts around.
Comment 8 Matej Cepl 2022-11-22 15:26:20 UTC
* SUSE:SLE-15-SP2:Update ssr#284868
* SUSE:SLE-15-SP3:Update ssr#284871

Thanks to Simon Lees for doing the really hard work to make it work.
Comment 10 Simon Lees 2022-11-24 05:04:52 UTC
Do we know of any usecases in the CloudX products? the patch is significantly harder to backport and it would be great if I could do some more testing.
Comment 11 Swamp Workflow Management 2022-11-24 20:22:31 UTC
SUSE-SU-2022:4215-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1205318
CVE References: CVE-2022-37026
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    erlang-22.3-150300.3.3.1
openSUSE Leap 15.3 (src):    erlang-22.3-150300.3.3.1
SUSE Linux Enterprise Module for Server Applications 15-SP4 (src):    erlang-22.3-150300.3.3.1
SUSE Linux Enterprise Module for Server Applications 15-SP3 (src):    erlang-22.3-150300.3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Swamp Workflow Management 2022-11-25 17:19:37 UTC
SUSE-SU-2022:4222-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1205318
CVE References: CVE-2022-37026
JIRA References: 
Sources used:
SUSE Manager Server 4.1 (src):    erlang-22.2.7-150200.3.3.1
SUSE Manager Retail Branch Server 4.1 (src):    erlang-22.2.7-150200.3.3.1
SUSE Manager Proxy 4.1 (src):    erlang-22.2.7-150200.3.3.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    erlang-22.2.7-150200.3.3.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    erlang-22.2.7-150200.3.3.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    erlang-22.2.7-150200.3.3.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    erlang-22.2.7-150200.3.3.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    erlang-22.2.7-150200.3.3.1
SUSE Enterprise Storage 7 (src):    erlang-22.2.7-150200.3.3.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Sascha Weber 2022-11-28 10:15:07 UTC
Adding @Keith Berger to provide insight into SOC customers impact.
Comment 14 Simon Lees 2022-11-30 11:37:31 UTC
I now have the test suite somewhat running and it seems likely that there is some form of regression introduced with this fix. I will have a look in more detail tomorrow.