Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 765796 (CVE-2020-35733) - <dev-lang/erlang-23.2.2: Invalid TLS certificate validation (CVE-2020-35733)
Summary: <dev-lang/erlang-23.2.2: Invalid TLS certificate validation (CVE-2020-35733)
Alias: CVE-2020-35733
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
Whiteboard: B4 [glsa cve]
Depends on: 755236
Blocks: CVE-2020-25623
  Show dependency tree
Reported: 2021-01-17 19:53 UTC by Sam James
Modified: 2022-03-12 08:09 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-01-17 19:53:23 UTC
"An issue was discovered in Erlang/OTP before 23.2.2. The ssl application 10.2 accepts and trusts an invalid X.509 certificate chain to a trusted root Certification Authority."
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-01-17 19:53:53 UTC
Please tell us when ready to stable, expedited if possible.
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2021-01-28 03:01:41 UTC
Comment 3 John Helmert III gentoo-dev Security 2021-02-06 16:43:29 UTC
Erlang 23.2.1 isn't sufficient to fix this bug.
Comment 4 NATTkA bot gentoo-dev 2021-03-06 10:16:56 UTC Comment hidden (obsolete)
Comment 5 John Helmert III gentoo-dev Security 2021-03-06 14:57:18 UTC
Stabilization was done in bug 773016. Please cleanup.
Comment 6 John Helmert III gentoo-dev Security 2021-03-13 16:14:24 UTC
Ping. Please cleanup.
Comment 7 Larry the Git Cow gentoo-dev 2021-04-28 18:16:28 UTC
The bug has been referenced in the following commit(s):

commit f06f1d7a8d16f0c9730128c56f2a8e22e88b42a3
Author:     Sergei Trofimovich <>
AuthorDate: 2021-04-28 18:16:02 +0000
Commit:     Sergei Trofimovich <>
CommitDate: 2021-04-28 18:16:23 +0000

    dev-lang/erlang: drop old
    Package-Manager: Portage-3.0.18, Repoman-3.0.3
    Signed-off-by: Sergei Trofimovich <>

 dev-lang/erlang/Manifest             |   3 -
 dev-lang/erlang/erlang-23.0.4.ebuild | 158 -----------------------------------
 2 files changed, 161 deletions(-)
Comment 8 John Helmert III gentoo-dev Security 2021-07-25 02:12:57 UTC
GLSA request filed.
Comment 9 NATTkA bot gentoo-dev 2021-07-29 17:24:28 UTC Comment hidden (obsolete)
Comment 10 NATTkA bot gentoo-dev 2021-07-29 17:32:58 UTC Comment hidden (obsolete)
Comment 11 NATTkA bot gentoo-dev 2021-07-29 17:40:49 UTC Comment hidden (obsolete)
Comment 12 NATTkA bot gentoo-dev 2021-07-29 17:48:59 UTC Comment hidden (obsolete)
Comment 13 NATTkA bot gentoo-dev 2021-07-29 18:04:55 UTC Comment hidden (obsolete)
Comment 14 NATTkA bot gentoo-dev 2021-07-29 18:13:13 UTC
Package list is empty or all packages have requested keywords.
Comment 15 Matthew Smith gentoo-dev 2022-03-12 08:09:54 UTC
Affected versions no longer in tree.