CVE-2017-1000385

The Erlang otp TLS server answers with different TLS alerts to different error types in the RSA PKCS #1 1.5 padding. This allows an attacker to decrypt content or sign messages with the server's private key (this is a variation of the Bleichenbacher attack).

• CWE-203

• http://erlang.org/pipermail/erlang-questions/2017-November/094255.htmlIssue Tracking, Mailing List, Vendor Advisory
• http://erlang.org/pipermail/erlang-questions/2017-November/094256.htmlIssue Tracking, Mailing List, Vendor Advisory
• http://erlang.org/pipermail/erlang-questions/2017-November/094257.htmlIssue Tracking, Mailing List, Vendor Advisory
• http://www.securityfocus.com/bid/102197Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:0242
• https://access.redhat.com/errata/RHSA-2018:0303
• https://access.redhat.com/errata/RHSA-2018:0368
• https://access.redhat.com/errata/RHSA-2018:0528
• https://lists.debian.org/debian-lts-announce/2017/12/msg00010.html
• https://robotattack.org/Issue Tracking, Third Party Advisory
• https://usn.ubuntu.com/3571-1/
• https://www.debian.org/security/2017/dsa-4057Issue Tracking, Third Party Advisory
• https://www.kb.cert.org/vuls/id/144389Issue Tracking, Third Party Advisory, US Government Resource
• http://erlang.org/pipermail/erlang-questions/2017-November/094255.htmlIssue Tracking, Mailing List, Vendor Advisory
• http://erlang.org/pipermail/erlang-questions/2017-November/094256.htmlIssue Tracking, Mailing List, Vendor Advisory
• http://erlang.org/pipermail/erlang-questions/2017-November/094257.htmlIssue Tracking, Mailing List, Vendor Advisory
• http://www.securityfocus.com/bid/102197Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:0242
• https://access.redhat.com/errata/RHSA-2018:0303
• https://access.redhat.com/errata/RHSA-2018:0368
• https://access.redhat.com/errata/RHSA-2018:0528
• https://lists.debian.org/debian-lts-announce/2017/12/msg00010.html
• https://robotattack.org/Issue Tracking, Third Party Advisory
• https://usn.ubuntu.com/3571-1/
• https://www.debian.org/security/2017/dsa-4057Issue Tracking, Third Party Advisory
• https://www.kb.cert.org/vuls/id/144389Issue Tracking, Third Party Advisory, US Government Resource

Published

Dec 12, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-1000379The Linux Kernel running on AMD64 systems will sometimes map…7.8
• CVE-2017-1000380sound/core/timer.c in the Linux kernel before 4.11.5 is vuln…
• CVE-2017-1000381The c-ares function `ares_parse_naptr_reply()`, which is use…7.5
• CVE-2017-1000382VIM version 8.0.1187 (and other versions most likely) ignore…
• CVE-2017-1000383GNU Emacs version 25.3.1 (and other versions most likely) ig…
• CVE-2017-1000384Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-1000386Jenkins Active Choices plugin version 1.5.3 and earlier allo…
• CVE-2017-1000387Jenkins Build-Publisher plugin version 1.21 and earlier stor…
• CVE-2017-1000388Jenkins Dependency Graph Viewer plugin 0.12 and earlier did …
• CVE-2017-1000389Some URLs provided by Jenkins global-build-stats plugin vers…
• CVE-2017-1000390Jenkins Multijob plugin version 1.25 and earlier did not che…
• CVE-2017-1000391Jenkins versions 2.88 and earlier and 2.73.2 and earlier sto…