UbuntuUpdates.org

Package "erlang-base"

Name: erlang-base

Description:

Erlang/OTP virtual machine and base applications
Latest version: 1:24.2.1+dfsg-1ubuntu0.8
Release: jammy (22.04)
Level: security
Repository: main
Head package: erlang
Homepage: http://www.erlang.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "erlang-base"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "erlang-base" in Jammy

Repository Area Version
base main 1:24.2.1+dfsg-1
updates main 1:24.2.1+dfsg-1ubuntu0.8

Changelog

Version: 1:24.2.1+dfsg-1ubuntu0.8 2026-10-08 04:07:13 UTC

erlang (1:24.2.1+dfsg-1ubuntu0.8) jammy-security; urgency=medium

  * debian/patches/CVE-2022-37026-1.patch: call
    ssl_gen_statem:handle_own_alert/3, the only arity that exists in this
    version, instead of a non-existent handle_own_alert/4, so unexpected
    application data and certificate verify errors raise a TLS/DTLS alert
    instead of crashing the connection process with undef, in
    lib/ssl/src/dtls_connection.erl, lib/ssl/src/tls_connection.erl,
    lib/ssl/src/tls_gen_connection.erl.
  * SECURITY UPDATE: Path Traversal
    - debian/patches/CVE-2026-21620-1.patch: Validate initial options in
      lib/tftp/src/tftp_file.erl.
    - debian/patches/CVE-2026-21620-2.patch: Rewrite old style catch in
      lib/tftp/src/tftp_file.erl.
    - debian/patches/CVE-2026-21620-3.patch: Fix typos in
      lib/tftp/src/tftp_file.erl.
    - debian/patches/CVE-2026-21620-4.patch: Fix an incorrect type and a few
      bugs in lib/tftp/src/tftp_file.erl.
    - CVE-2026-21620
  * SECURITY UPDATE: Path Traversal
    - debian/patches/CVE-2026-23942.patch: ssh: Fix path traversal vulnerability
      in ssh_sftpd root directory validation in lib/ssh/src/ssh_sftpd.erl.
    - CVE-2026-23942
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-23943.patch: Disable zlib by default and limit
      size of decompressed data in lib/ssh/src/ssh_connection_handler.erl,
      lib/ssh/src/ssh_transport.erl.
    - CVE-2026-23943
  * SECURITY UPDATE: Authentication Bypass
    - debian/patches/CVE-2026-28808.patch: inets: Check script_alias when using
      mod_auth in lib/inets/src/http_server/mod_alias.erl.
    - CVE-2026-28808
  * SECURITY UPDATE: DNS Cache Poisoning
    - debian/patches/CVE-2026-28810-pre1.patch: Use case insensitive domain
      compare in lib/kernel/src/inet_db.erl.
    - debian/patches/CVE-2026-28810-pre2.patch: Make domain name comparison
      ignore trailing dot in lib/kernel/src/inet_db.erl.
    - debian/patches/CVE-2026-28810-1.patch: Randomize `inet_res` transaction ID
      and source port number in lib/kernel/doc/src/inet_res.xml,
      lib/kernel/src/gen_udp.erl, lib/kernel/src/inet.erl,
      lib/kernel/src/inet6_udp.erl, lib/kernel/src/inet_db.erl,
      lib/kernel/src/inet_dns.erl, lib/kernel/src/inet_res.erl,
      lib/kernel/src/inet_udp.erl, lib/kernel/test/inet_res_SUITE.erl.
    - debian/patches/CVE-2026-28810-2.patch: Update after feedback in
      lib/kernel/src/gen_udp.erl, lib/kernel/src/inet.erl,
      lib/kernel/src/inet6_sctp.erl, lib/kernel/src/inet_db.erl,
      lib/kernel/src/inet_dns.erl, lib/kernel/src/inet_res.erl,
      lib/kernel/src/inet_sctp.erl.
    - debian/patches/CVE-2026-28810-3.patch: Fix handling of truncation bit vs.
      truncated sections in lib/kernel/src/inet_dns.erl,
      lib/kernel/src/inet_res.erl, lib/kernel/test/inet_res_SUITE.erl.
    - debian/patches/CVE-2026-28810-4.patch: Do not drop random mode after
      getting econnrefused in lib/kernel/src/inet_res.erl.
    - CVE-2026-28810
  * SECURITY UPDATE: Path Traversal
    - debian/patches/CVE-2026-32147.patch: Fix root escape vulnerability in
      SSH_FXP_FSETSTAT in lib/ssh/src/ssh_sftpd.erl.
    - CVE-2026-32147
  * SECURITY UPDATE: Certificate Validation Bypass
    - debian/patches/CVE-2026-42789.patch: public_key: Update to stricter check
      as clearly defined in RFC 5280 in lib/public_key/src/pubkey_cert.erl.
    - CVE-2026-42789
  * SECURITY UPDATE: Certificate Validation Bypass
    - debian/patches/CVE-2026-42790-1.patch: public_key: Adhere to RFC 9525 in
      lib/public_key/src/public_key.erl.
    - debian/patches/CVE-2026-42790-2.patch: public_key: Add new error in
      lib/public_key/doc/src/public_key.xml, lib/public_key/src/pubkey_cert.erl,
      lib/public_key/test/pkits_SUITE.erl.
    - debian/patches/CVE-2026-42790-3.patch: ssl: Improve error handling due to
      public_key updates. in lib/ssl/src/ssl_handshake.erl.
    - CVE-2026-42790
  * SECURITY UPDATE: Information Disclosure
    - debian/patches/CVE-2026-48855.patch: Fix absolute path leak from
      SSH_FXP_READLINK in lib/ssh/src/ssh_sftpd.erl.
    - CVE-2026-48855
  * SECURITY UPDATE: Information Disclosure
    - debian/patches/CVE-2026-48856.patch: inets/httpc: strip sensitive headers
      on cross-origin redirect in lib/inets/src/http_client/httpc_response.erl.
    - CVE-2026-48856
  * SECURITY UPDATE: Server-Side Request Forgery
    - debian/patches/CVE-2026-48858.patch: ftp: validate PASV response IP
      against control connection peer in lib/ftp/src/ftp.erl.
    - CVE-2026-48858
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-49759-1.patch: Protect the output term buffer from
      overflow in erts/emulator/drivers/common/inet_drv.c.
    - debian/patches/CVE-2026-49759-2.patch: Rewrite error parse loop to handle
      all lengths in erts/emulator/drivers/common/inet_drv.c.
    - CVE-2026-49759
  * SECURITY UPDATE: Buffer Overflow
    - debian/patches/CVE-2026-49760.patch: erl_interface: Fix stack overflow in
      ei_s_print_term in lib/erl_interface/src/misc/ei_printterm.c,
      lib/erl_interface/test/ei_print_SUITE_data/ei_print_test.c.
    - CVE-2026-49760
  * SECURITY UPDATE: Information Disclosure
    - debian/patches/CVE-2026-53422.patch: Fix realpath path existence oracle in
      lib/ssh/src/ssh_sftpd.erl.
    - CVE-2026-53422
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-54886.patch: Fix extended data infinite loop in
      sftpd in lib/ssh/src/ssh_sftpd.erl, lib/ssh/test/ssh_sftpd_SUITE.erl.
    - CVE-2026-54886
  * SECURITY UPDATE: Security Bypass
    - debian/patches/CVE-2026-54887.patch: ssl: Avoid cookie forgery during
      setup up window in lib/ssl/src/dtls_connection.erl.
    - CVE-2026-54887
  * SECURITY UPDATE: Plaintext Injection
    - debian/patches/CVE-2026-54891.patch: ssl: TLS Client hardening in
      lib/ssl/src/tls_gen_connection.erl.
    - CVE-2026-54891
  * SECURITY UPDATE: Denial of Service
    - debian/p
Source diff to previous version
CVE-2022-37026 In Erlang/OTP before 23.3.4.15, 24.x before 24.3.4.2, and 25.x before 25.0.2, there is a Client Authentication Bypass in certain client-certification
CVE-2026-21620 Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tft
CVE-2026-23942 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal.
CVE-2026-23943 Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via R
CVE-2026-28808 Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when se
CVE-2026-28810 Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning. The buil
CVE-2026-32147 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authentic
CVE-2026-42789 Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be ac
CVE-2026-42790 Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_cert and public_key modules) allows a DNS nameConstraints bypass via s
CVE-2026-48855 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Erlang OTP ssh (ssh_sftpd module) allows File Discovery. The SSH_FXP_REA
CVE-2026-48856 Sensitive Data Exposure vulnerability in Erlang OTP inets (httpc_response module) allows Retrieve Embedded Sensitive Data. The httpc client forwards
CVE-2026-48858 Server-Side Request Forgery (SSRF) vulnerability in Erlang/OTP ftp (ftp_internal module) allows FTP bounce attacks and SSRF via an unvalidated PASV r
CVE-2026-49759 Stack-based Buffer Overflow vulnerability in Erlang OTP erts (inet_drv) allows an unauthenticated remote attacker to crash the BEAM VM by sending a c
CVE-2026-49760 Stack-based Buffer Overflow vulnerability in Erlang OTP (erl_interface) allows Stack-based Buffer Overflow. This vulnerability is associated with pr
CVE-2026-53422 Observable Response Discrepancy vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to enumerate the existence of fi
CVE-2026-54886 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows an authenticated SFTP user to render
CVE-2026-54887 Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl (DTLS server) allows predictable DTLS cookie computation during the startup window,
CVE-2026-54891 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl (tls_gen_connection module)
CVE-2026-55952 The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension
CVE-2026-47078 Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted
CVE-2026-74994 The mod_auth module in OTP's inets httpd server, when configured with dets or mnesia authentication backends and multiple directory configuration blo
CVE-2026-65634 Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial of servi
CVE-2026-68956 Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory b
CVE-2026-89422 Key Exchange without Entity Authentication vulnerability in Erlang/OTP ssl allows a peer that answers a TLS 1.3 client connection to impersonate the

Version: 1:24.2.1+dfsg-1ubuntu0.7 2026-09-28 02:07:19 UTC

erlang (1:24.2.1+dfsg-1ubuntu0.7) jammy-security; urgency=medium

  * SECURITY UPDATE: denial of service in the Erlang Port Mapper Daemon
    - debian/patches/CVE-2026-42792.patch: epmd: Improve slow-connection
      handling in erts/epmd/src/epmd_srv.c.
    - CVE-2026-42792
  * SECURITY UPDATE: buffer overflow via crafted packet length
    - debian/patches/CVE-2026-75538.patch: Avoid signed int overflows in
      erts/emulator/beam/packet_parser.c,
      erts/emulator/drivers/common/inet_drv.c.
    - CVE-2026-75538
  * SECURITY UPDATE: buffer overflow in the megaco flex scanner
    - debian/patches/CVE-2026-59250.patch: megaco: fix sprintf buffer overflow
      in flex scanner in lib/megaco/src/flex/megaco_flex_scanner_drv.flex.src.
    - CVE-2026-59250
  * SECURITY UPDATE: TLS clients accepted cipher suites they did not offer
    - debian/patches/CVE-2026-55953.patch: ssl: Add pre TLS-1.3 client cipher
      suite check in lib/ssl/src/ssl_handshake.erl.
    - CVE-2026-55953
  * SECURITY UPDATE: denial of service via crafted certificate chains
    - debian/patches/CVE-2026-58227.patch: ssl: Use digraph to ensure robust
      cert chain building. in lib/ssl/src/ssl_certificate.erl,
      lib/ssl/test/ssl_cert_SUITE.erl.
    - CVE-2026-58227
  * SECURITY UPDATE: HTTP request smuggling via conflicting framing headers
    - debian/patches/CVE-2026-73812-pre1.patch: Prevent httpd from parsing HTTP
      requests when multiple Content-Length headers are present in
      lib/inets/src/http_server/httpd_request.erl,
      lib/inets/src/http_server/httpd_request_handler.erl,
      lib/inets/test/httpd_SUITE.erl.
    - debian/patches/CVE-2026-73812.patch: inets: Reject requests with both
      Transfer-Encoding and Content-Length in
      lib/inets/src/http_server/httpd_internal.hrl,
      lib/inets/src/http_server/httpd_request.erl,
      lib/inets/test/http_test_lib.erl, lib/inets/test/httpc_SUITE.erl.
    - CVE-2026-23941
    - CVE-2026-73812
  * SECURITY UPDATE: denial of service via malformed chunk sizes
    - debian/patches/CVE-2026-69664.patch: inets: Fix rejection of invalid chunk
      sizes in lib/inets/src/http_server/httpd_request_handler.erl,
      lib/inets/test/httpd_SUITE.erl.
    - CVE-2026-69664
  * SECURITY UPDATE: denial of service via unbounded chunked request bodies
    - debian/patches/CVE-2026-74835.patch: inets: Fix max_body_size to apply to
      chunks as we receive them in lib/inets/src/http_lib/http_chunk.erl,
      lib/inets/src/http_server/httpd_request_handler.erl,
      lib/inets/test/http_format_SUITE.erl.
    - CVE-2026-74835
  * SECURITY UPDATE: authentication bypass via path equivalence / authentication bypass via inconsistent case handling
    - debian/patches/CVE-2026-66835_73270.patch: inets: Canonicalize request
      path before mod_auth directory check in
      lib/inets/src/http_server/httpd_request.erl,
      lib/inets/src/http_server/httpd_util.erl,
      lib/inets/src/http_server/mod_alias.erl,
      lib/inets/src/http_server/mod_auth.erl.
    - CVE-2026-66835
    - CVE-2026-73270
  * SECURITY UPDATE: denial of service via unlimited simultaneous connections
    - debian/patches/CVE-2026-70399.patch: inets: Fix default max_clients in
      lib/inets/src/http_lib/http_internal.hrl,
      lib/inets/src/http_server/httpd_manager.erl.
    - CVE-2026-70399
  * SECURITY UPDATE: HTTP request smuggling via header continuation lines
    - debian/patches/CVE-2026-66357.patch: inets: Reject obs-fold header
      continuation in httpd (RFC 9112) in
      lib/inets/src/http_server/httpd_request.erl,
      lib/inets/test/httpd_SUITE.erl.
    - CVE-2026-66357
  * SECURITY UPDATE: HTTP request smuggling via malformed header names
    - debian/patches/CVE-2026-73276.patch: inets: Reject headers with whitespace
      before colon in httpd in lib/inets/src/http_lib/http_request.erl,
      lib/inets/src/http_server/httpd_request.erl,
      lib/inets/test/httpd_SUITE.erl.
    - debian/patches/CVE-2026-73276-2.patch: httpd: add error handling for
      headers with whitespace before colon in
      lib/inets/src/http_lib/http_request.erl,
      lib/inets/src/http_server/httpd_internal.hrl,
      lib/inets/src/http_server/httpd_request.erl.
    - CVE-2026-73276
  * SECURITY UPDATE: authentication bypass via inconsistent case handling
    - debian/patches/CVE-2026-73270-2.patch: inets: Add caseless matching to
      mod_security directory lookup in lib/inets/src/http_server/httpd_util.erl,
      lib/inets/src/http_server/mod_security.erl.
    - CVE-2026-73270
  * SECURITY UPDATE: denial of service via incomplete request bodies
    - debian/patches/CVE-2026-71380-pre1.patch: inets: Adjust keep_alive_timeout
      effective measurement in httpd in
      lib/inets/src/http_server/httpd_conf.erl,
      lib/inets/src/http_server/httpd_request_handler.erl.
    - debian/patches/CVE-2026-71380-pre2.patch: inets: Add httpd option
      max_body_read_timeout in lib/inets/src/http_lib/http_internal.hrl,
      lib/inets/src/http_server/httpd_conf.erl,
      lib/inets/src/http_server/httpd_request_handler.erl.
    - debian/patches/CVE-2026-71380-pre3.patch: inets: Send 408 when we hit
      min_bytes_per_second floor in
      lib/inets/src/http_server/httpd_request_handler.erl.
    - debian/patches/CVE-2026-71380.patch: inets: rename max_body_read_timeout
      option to request_timeout in lib/inets/src/http_lib/http_internal.hrl,
      lib/inets/src/http_server/httpd_conf.erl,
      lib/inets/src/http_server/httpd_request_handler.erl.
    - debian/patches/CVE-2026-71380-2.patch: Fix dialyzer errors in
      httpd_request_handler in
      lib/inets/src/http_server/httpd_request_handler.erl.
    - CVE-2026-71380
  * SECURITY UPDATE: denial of service via unbounded HTTP response headers
    - debian/patches/CVE-2026-55951-pre1.patch: OTP-19158 httpc enable options
      for async request in lib/inets/src/http_client/httpc.erl,
      lib/inets/src/http_client/httpc_handler.erl,
      lib/ine
Source diff to previous version
CVE-2026-42792 Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminat
CVE-2026-75538 An attacker that connects to an open Erlang TCP port that uses the inet driver with {packet,4} mode can use a signed overflow in an incorrect packet
CVE-2026-59250 Classic buffer overflow in the Erlang/OTP megaco flex scanner C driver allows a remote unauthenticated attacker to corrupt the driver's memory (and p
CVE-2026-55953 The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the server in ServerHello was among the su
CVE-2026-58227 The Erlang/OTP ssl application does not detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. In ssl
CVE-2026-73812 httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 ide
CVE-2026-23941 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smugglin
CVE-2026-69664 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denia
CVE-2026-74835 The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 befor
CVE-2026-66835 Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory
CVE-2026-73270 Improper Handling of Case Sensitivity vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_aut
CVE-2026-70399 Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denia
CVE-2026-66357 httpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet uncondition
CVE-2026-73276 Gracefulness code ignored cases that should be rejected, resulting in possible HTTP Request Smuggling opportunities. This issue affects OTP from OTP
CVE-2026-71380 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denia
CVE-2026-55951 The Erlang/OTP httpc HTTP client does not enforce a limit on the total size of response headers received from a server. The max_header_size option de

Version: 1:24.2.1+dfsg-1ubuntu0.6 2025-10-21 20:07:28 UTC

  erlang (1:24.2.1+dfsg-1ubuntu0.6) jammy-security; urgency=medium

  * SECURITY UPDATE: Increased resource consumption in the SSH module.
    - debian/patches/CVE-2025-48038.patch: Add handle_op for file handle length
      string exceeding 256 bytes in lib/ssh/src/ssh_sftpd.erl.
    - debian/patches/CVE-2025-48039.patch: Add max_path option and limits in
      lib/ssh/src/ssh_sftpd.erl.i
    - debian/patches/CVE-2025-48040-pre1.patch: Fix error by adding try catch
      in lib/ssh/src/ssh_transport.erl.
    - debian/patches/CVE-2025-48040.patch: Add max_log_len in
      lib/ssh/src/ssh_connection.erl. Add Class:Reason0:Stacktrace for decode
      failures in lib/ssh/src/ssh_connection_handler.erl. Add trim_reason and
      max_log_len in lib/ssh/src/ssh_lib.erl. Change decode_kex_init in
      lib/ssh/src/ssh_message.erl. Change kexinit_error and modify Msg in
      lib/ssh/src/ssh_transport.erl.
    - debian/patches/CVE-2025-48041.patch: Add max_handles option and limits in
      lib/ssh/src/ssh_sftpd.erl.
    - CVE-2025-48038
    - CVE-2025-48039
    - CVE-2025-48040
    - CVE-2025-48041

 -- Hlib Korzhynskyy <email address hidden> Fri, 17 Oct 2025 15:17:48 -0230
Source diff to previous version
CVE-2025-48038 Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Ex
CVE-2025-48039 Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Ex
CVE-2025-48040 Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is ass
CVE-2025-48041 Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This v

Version: 1:24.2.1+dfsg-1ubuntu0.5 2025-07-21 15:11:45 UTC

  erlang (1:24.2.1+dfsg-1ubuntu0.5) jammy-security; urgency=medium

  * SECURITY UPDATE: insufficient strict KEX handshake hardening measures
    - debian/patches/CVE-2025-46712-pre1.patch: postpone
      ssh_connection_handler init in
      lib/ssh/src/ssh_connection_handler.erl.
    - debian/patches/CVE-2025-46712-pre2.patch: implement KEX strict in
      lib/ssh/src/ssh.hrl, lib/ssh/src/ssh_connection_handler.erl,
      lib/ssh/src/ssh_fsm_kexinit.erl, lib/ssh/src/ssh_transport.erl,
      lib/ssh/src/ssh_transport.hrl, lib/ssh/test/ssh_protocol_SUITE.erl,
      lib/ssh/test/ssh_test_lib.erl, lib/ssh/test/ssh_to_openssh_SUITE.erl,
      lib/ssh/test/ssh_trpt_test_lib.erl.
    - debian/patches/CVE-2025-46712-1.patch: add KEX strict implementation
      fixes in lib/ssh/src/ssh_connection_handler.erl,
      lib/ssh/src/ssh_fsm_kexinit.erl, lib/ssh/src/ssh_transport.erl,
      lib/ssh/test/ssh_protocol_SUITE.erl,
      lib/ssh/test/ssh_trpt_test_lib.erl.
    - CVE-2025-46712
  * SECURITY UPDATE: path traversal and other issues in zip
    - debian/patches/CVE-2025-4748.patch: properly sanitize filenames when
      (un)zipping in lib/stdlib/src/zip.erl, lib/stdlib/test/zip_SUITE.erl.
    - CVE-2025-4748

 -- Marc Deslauriers <email address hidden> Thu, 10 Jul 2025 12:45:03 -0400
Source diff to previous version
CVE-2025-46712 Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and O
CVE-2025-4748 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Trav

Version: 1:24.2.1+dfsg-1ubuntu0.4 2025-04-18 14:08:58 UTC

  erlang (1:24.2.1+dfsg-1ubuntu0.4) jammy-security; urgency=medium

  * SECURITY UPDATE: Unauthenticated Remote Code Execution in SSH
    - debian/patches/CVE-2025-32433.patch: disconnect when connection
      protocol message arrives when user is not authenticated for
      connection in lib/ssh/src/ssh_connection.erl,
      lib/ssh/test/ssh_protocol_SUITE.erl.
    - CVE-2025-32433

 -- Marc Deslauriers <email address hidden> Wed, 16 Apr 2025 14:23:11 -0400
CVE-2025-32433 Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server ma


About   -   Send Feedback to @ubuntu_updates