Erlang/OTP ssl Client TLS 1.2 Anonymous Cipher Suite Authentication Bypass

Vulnerability Overview TLS 1.2 and DTLS clients accept anonymous cipher suites that were not provided, bypassing server authentication. The Erlang/OTP SSL module's TLS 1.2 (and earlier) and DTLS clients do not verify whether the cipher suite selected by the server in the was present in the client's . The handler validates the negotiated protocol version and downgrade sentinels, then passes the server-selected cipher suite directly to , which installs it without a membership check. The TLS 1.3 client path performs this check (per RFC 8446) and is therefore unaffected. An attacker on the path between the client and the intended server can use the response to offer anonymous key exchange suites, such as or , which the client did not offer. Anonymous suites do not require the server to present a certificate, thereby bypassing the entire and configuration. The attacker completes the handshake using their own ephemeral parameters, without verifying certificates or checking hostnames. As a result, returns . All subsequent application traffic is readable and modifiable by the attacker. This issue affects OTP from versions prior to OTP 17.0 up to OTP 29.0.4, OTP 28.5.0.4, and OTP 27.3.4.15, corresponding to ssl from versions prior to 5.3.4 up to 11.7.4, 11.6.0.4, and 11.2.12.11. Affected Components Erlang/OTP ssl: - Modules: , , - Source Files: , - Routines: , , , , - Status: Affected - Type: otp - Version: 5.3.4 - Changes/Fixes: - Unaffected in 11.7.4 - Unaffected in 11.6.0.4 - Unaffected in 11.2.12.11 pkg:github/erlang/otp: - Modules: , , - Source Files: , - Routines: , , , , - Status: Affected - Type: otp - Version: 17.0 - Changes/Fixes: - Unaffected in 29.0.4 - Unaffected in 28.0.0.4 - Unaffected in 27.3.4.15 - Status: Affected - Type: git - Version: 84adefa331 - Changes/Fixes: - Unaffected in 904e29d414 - Unaffected in 0a82596d42 - Unaffected in 6ff938110 Remediation Restrict the client to connecting only via TLS 1.3 by setting the version option to in the client's SSL options. The TLS 1.3 client path performs the necessary cipher suite membership check and is unaffected. Exploitation requires the attacker to be on the path (Man-in-the-Middle). Configuration This vulnerability only affects TLS clients using TLS 1.2 (or earlier) or DTLS. TLS 1.3 client connections perform cipher suite membership checks and are unaffected. Servers are unaffected. Exploitation also requires the attacker to be on the path (Man-in-the-Middle). References GitHub Security Advisory OSV Vulnerability GitHub Commit GitHub Commit GitHub Commit Contributors Discovered by: Jonatan Männchen / EEF Fix Developer: Ingela Anderton Andin Fix Reviewer: Jakub Witczak

Goal Reached Thanks to every supporter — we hit 100%!

Erlang/OTP ssl Client TLS 1.2 Anonymous Cipher Suite Authentication Bypass

More from this source