CVE-2025-46712 (GCVE-0-2025-46712)

Vulnerability from cvelistv5 – Published: 2025-05-08 19:26 – Updated: 2025-05-08 20:03
VLAI?
Summary
Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25), Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This allows a Man-in-the-Middle attacker to inject these messages in a connection during the handshake. This issue has been patched in versions OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25).
Severity ?
3.7 (Low)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE
  • CWE-440 - Expected Behavior Violation
Assigner
References
Impacted products
Vendor Product Version
erlang otp Affected: >= OTP 27.0, < OTP 27.3.4
Affected: >= OTP 26.2.1, < OTP 26.2.5.12
Affected: < OTP 25.3.2.21
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-46712",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-05-08T20:02:52.990837Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-05-08T20:03:27.225Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "otp",
          "vendor": "erlang",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= OTP 27.0, \u003c OTP 27.3.4"
            },
            {
              "status": "affected",
              "version": "\u003e= OTP 26.2.1, \u003c OTP 26.2.5.12"
            },
            {
              "status": "affected",
              "version": "\u003c OTP 25.3.2.21"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25), Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This allows a Man-in-the-Middle attacker to inject these messages in a connection during the handshake. This issue has been patched in versions OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-440",
              "description": "CWE-440: Expected Behavior Violation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-08T19:26:27.563Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/erlang/otp/security/advisories/GHSA-934x-xq38-hhqf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/erlang/otp/security/advisories/GHSA-934x-xq38-hhqf"
        },
        {
          "name": "https://github.com/erlang/otp/releases/tag/OTP-25.3.2.21",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/erlang/otp/releases/tag/OTP-25.3.2.21"
        },
        {
          "name": "https://github.com/erlang/otp/releases/tag/OTP-26.2.5.12",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/erlang/otp/releases/tag/OTP-26.2.5.12"
        },
        {
          "name": "https://github.com/erlang/otp/releases/tag/OTP-27.3.4",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/erlang/otp/releases/tag/OTP-27.3.4"
        }
      ],
      "source": {
        "advisory": "GHSA-934x-xq38-hhqf",
        "discovery": "UNKNOWN"
      },
      "title": "Erlang/OTP SSH Has Strict KEX Violations"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-46712",
    "datePublished": "2025-05-08T19:26:27.563Z",
    "dateReserved": "2025-04-28T20:56:09.082Z",
    "dateUpdated": "2025-05-08T20:03:27.225Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-46712\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2025-05-08T20:15:30.807\",\"lastModified\":\"2025-05-12T17:32:52.810\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25), Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This allows a Man-in-the-Middle attacker to inject these messages in a connection during the handshake. This issue has been patched in versions OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25).\"},{\"lang\":\"es\",\"value\":\"Erlang/OTP es un conjunto de librer\u00edas para el lenguaje de programaci\u00f3n Erlang. En versiones anteriores a OTP-27.3.4 (para OTP-27), OTP-26.2.5.12 (para OTP-26) y OTP-25.3.2.21 (para OTP-25), Erlang/OTP SSH no aplica medidas estrictas de reforzamiento del protocolo de enlace KEX al permitir el intercambio de mensajes opcionales. Esto permite que un atacante intermediario inyecte estos mensajes en una conexi\u00f3n durante el protocolo de enlace. Este problema se ha corregido en las versiones OTP-27.3.4 (para OTP-27), OTP-26.2.5.12 (para OTP-26) y OTP-25.3.2.21 (para OTP-25).\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\",\"baseScore\":3.7,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.2,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-440\"}]}],\"references\":[{\"url\":\"https://github.com/erlang/otp/releases/tag/OTP-25.3.2.21\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/erlang/otp/releases/tag/OTP-26.2.5.12\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/erlang/otp/releases/tag/OTP-27.3.4\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/erlang/otp/security/advisories/GHSA-934x-xq38-hhqf\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-46712\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-05-08T20:02:52.990837Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-05-08T20:03:07.079Z\"}}], \"cna\": {\"title\": \"Erlang/OTP SSH Has Strict KEX Violations\", \"source\": {\"advisory\": \"GHSA-934x-xq38-hhqf\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 3.7, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"erlang\", \"product\": \"otp\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= OTP 27.0, \u003c OTP 27.3.4\"}, {\"status\": \"affected\", \"version\": \"\u003e= OTP 26.2.1, \u003c OTP 26.2.5.12\"}, {\"status\": \"affected\", \"version\": \"\u003c OTP 25.3.2.21\"}]}], \"references\": [{\"url\": \"https://github.com/erlang/otp/security/advisories/GHSA-934x-xq38-hhqf\", \"name\": \"https://github.com/erlang/otp/security/advisories/GHSA-934x-xq38-hhqf\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/erlang/otp/releases/tag/OTP-25.3.2.21\", \"name\": \"https://github.com/erlang/otp/releases/tag/OTP-25.3.2.21\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/erlang/otp/releases/tag/OTP-26.2.5.12\", \"name\": \"https://github.com/erlang/otp/releases/tag/OTP-26.2.5.12\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/erlang/otp/releases/tag/OTP-27.3.4\", \"name\": \"https://github.com/erlang/otp/releases/tag/OTP-27.3.4\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25), Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This allows a Man-in-the-Middle attacker to inject these messages in a connection during the handshake. This issue has been patched in versions OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and OTP-25.3.2.21 (for OTP-25).\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-440\", \"description\": \"CWE-440: Expected Behavior Violation\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2025-05-08T19:26:27.563Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-46712\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-05-08T20:03:27.225Z\", \"dateReserved\": \"2025-04-28T20:56:09.082Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2025-05-08T19:26:27.563Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.