CVE-2026-54891— Erlang/OTP 加密问题漏洞

Plaintext APPLICATION_DATA injected during TLS handshake delivered to client application post-handshake in ssl

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module) allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server data. The function tls_gen_connection:handle_protocol_record/3 rejects APPLICATION_DATA records that arrive in pre-handshake states when the TLS endpoint acts as a server, but does not apply the same check when the endpoint acts as a client. A network-positioned attacker can send plaintext APPLICATION_DATA records to the client during the handshake. The records are buffered and, once the handshake completes successfully, delivered to the application as if they were authenticated post-handshake data. The attacker cannot observe the client's response or steer the connection, so the impact is limited to blind injection of unauthenticated bytes. The injection window is wider for TLS versions prior to TLS 1.3 than for TLS 1.3. This vulnerability is associated with program file lib/ssl/src/tls_gen_connection.erl. This issue affects OTP from OTP 17.0 before 29.0.3, 28.5.0.3 and 27.3.4.14 corresponding to ssl from 5.3.4 before 11.7.3, 11.6.0.3 and 11.2.12.10. TLS 1.3 is affected starting with OTP 22.0, when TLS 1.3 support was added.

N/A

通信信道中传输过程中消息完整性的不正确执行

Erlang/OTP 加密问题漏洞

erlang erlang/otp是erlang社区开源的一套并发编程语言及运行时系统。 Erlang/OTP存在加密问题漏洞，该漏洞源于通信信道中的消息完整性执行不当（tls_gen_connection模块问题），可能导致网络攻击者注入未经认证的明文数据并被视为已认证的服务器数据，攻击者在握手期间向客户端发送明文APPLICATION_DATA记录，在握手完成后传递给应用，影响仅限于盲注未经认证的字节。以下版本受到影响：17.0版本至29.0.3之前版本、28.5.0.3版本和27.3.4.14版本。

N/A

N/A