Medium severity · published May 15, 2020
CVE-2020-12872
yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP virtual machine with…
5.5
CVSS
0.4%
EPSS
No
On KEV
Description
yaws_config.erl in Yaws through 2.0.2 and/or 2.0.7 loads obsolete TLS ciphers, as demonstrated by ones that allow Sweet32 attacks, if running on an Erlang/OTP virtual machine with a version less than 21.0.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
YA
Yaws · Yaws
2.0.2 through 2.0.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-12872
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-12872
Exploit
https://github.com/erlyaws/yaws/blob/c0fd79f17d52628fcec527da7fa3e788c283c445/src/yaws_config.erl#L2068-L2075
Issue Tracking
https://github.com/erlyaws/yaws/issues/402
Release Notes
https://github.com/erlyaws/yaws/releases
medium.com
https://medium.com/%40charlielabs101/cve-2020-12872-df315411aa70
Third Party Advisory
https://sweet32.info/
More from Yaws
9.8
CVE-2020-24916
CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection
9.8
CVE-2020-24379
WebDAV implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to XXE injection
7.5
CVE-2017-10974
Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080
6.5
CVE-2011-4350
Yaws 1.91 has a directory traversal vulnerability in the way certain URLs are processed
6.1
CVE-2016-1000108
yaws before 2.0.4 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client…