Arch Linux alert ASA-202101-39 (erlang)

From:
             
 
Morten Linderud via arch-security <arch-security@lists.archlinux.org>
To:
             
 
arch-security@archlinux.org
Subject:
             
 
[ASA-202101-39] erlang: certificate verification bypass
Date:
             
 
Thu, 28 Jan 2021 23:00:46 +0100
Message-ID:
             
 
<20210128220046.jaspyj66ey257ibr@anathema>
Cc:
             
 
Morten Linderud <foxboron@archlinux.org>
Arch Linux Security Advisory ASA-202101-39
==========================================

Severity: High
Date    : 2021-01-20
CVE-ID  : CVE-2020-35733
Package : erlang
Type    : certificate verification bypass
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1457

Summary
=======

The package erlang before version 23.2.2-1 is vulnerable to certificate
verification bypass.

Resolution
==========

Upgrade to 23.2.2-1.

# pacman -Syu "erlang>=23.2.2-1"

The problem has been fixed upstream in version 23.2.2.

Workaround
==========

None.

Description
===========

An issue was discovered in Erlang/OTP before 23.2.2. The ssl
application 10.2 accepts and trusts an invalid X.509 certificate chain
to a trusted root Certification Authority.

Impact
======

The library would accept invalid certificates.

References
==========

https://erlang.org/pipermail/erlang-questions/2021-Januar...
https://github.com/erlang/otp/commit/a59f3c4d2be19343f43c...
https://security.archlinux.org/CVE-2020-35733