CVE-2020-35733
Description
A flaw was found in the OTP component of Erlang. The SSL application accepts and trusts invalid X.509 certificate chains. An attacker, able to create a fake certificate chain, could create a man-in-the-middle attack. The highest threat from this vulnerability is to data confidentiality.
Statement
Red Hat CloudForms 5.10 ships affected erlang-OTP component but the product does not use it in a vulnerable way; therefore, the impact is low. The newer version of CloudForms 5.11 does not include the affected component.
Red Hat Ansible Tower 3.6 ships 20.3.8.21 erlang-OTP component but this version never introduced the vulnerability, therefore is not affected. The newer versions of Red Hat Ansible Tower 3.7 and Red Hat Ansible Automation Platform which ships Ansible Tower 3.8 do not include the erlang dependency.
All supported releases of Red Hat OpenStack Platform ship the affected Erlang component, however it is only used as a dependency for RabbitMQ and is not exposed outside the management network. As this network is tightly-regulated to OpenStack administrators, the risk for abuse is significantly reduced.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | 7.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Integrity,Authentication
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
