Ubuntu.comUB:CVE-2020-12872CVE-2020-12872
2.1 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
35.5%
yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS
ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on
an Erlang/OTP virtual machine with a version less than 21.0.
References
github.com/erlyaws/yaws/blob/c0fd79f17d52628fcec527da7fa3e788c283c445/src/yaws_config.erl#L2068-L2075
github.com/erlyaws/yaws/releases
launchpad.net/bugs/cve/CVE-2020-12872
medium.com/@charlielabs101/cve-2020-12872-df315411aa70
nvd.nist.gov/vuln/detail/CVE-2020-12872
security-tracker.debian.org/tracker/CVE-2020-12872
sweet32.info/
www.cve.org/CVERecord?id=CVE-2020-12872
Related
2.1 Low
CVSS2
Attack Vector
LOCAL
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:L/AC:L/Au:N/C:P/I:N/A:N
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
0.001 Low
EPSS
Percentile
35.5%