Package "erlang-ssl"
| Name: |
erlang-ssl
|
Description: |
Erlang/OTP implementation of SSL
|
| Latest version: |
1:27.3+dfsg-1ubuntu1.3 |
| Release: |
plucky (25.04) |
| Level: |
security |
| Repository: |
main |
| Head package: |
erlang |
| Homepage: |
http://www.erlang.org/ |
Links
Download "erlang-ssl"
Other versions of "erlang-ssl" in Plucky
Changelog
|
erlang (1:27.3+dfsg-1ubuntu1.3) plucky-security; urgency=medium
* SECURITY UPDATE: Increased resource consumption in the SSH module.
- debian/patches/CVE-2025-48038.patch: Add handle_op for file handle length
string exceeding 256 bytes in lib/ssh/src/ssh_sftpd.erl.
- debian/patches/CVE-2025-48039.patch: Add max_path option and limits in
lib/ssh/src/ssh_sftpd.erl.
- debian/patches/CVE-2025-48040.patch: Add max_log_len in
lib/ssh/src/ssh_connection.erl. Add Class:Reason0:Stacktrace for decode
failures in lib/ssh/src/ssh_connection_handler.erl. Add trim_reason and
max_log_len in lib/ssh/src/ssh_lib.erl. Change decode_kex_init in
lib/ssh/src/ssh_message.erl. Change kexinit_error and modify Msg in
lib/ssh/src/ssh_transport.erl.
- debian/patches/CVE-2025-48041.patch: Add max_handles option and limits in
lib/ssh/src/ssh_sftpd.erl.
- CVE-2025-48038
- CVE-2025-48039
- CVE-2025-48040
- CVE-2025-48041
-- Hlib Korzhynskyy <email address hidden> Fri, 17 Oct 2025 10:34:49 -0230
|
| Source diff to previous version |
| CVE-2025-48038 |
Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Ex |
| CVE-2025-48039 |
Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Ex |
| CVE-2025-48040 |
Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is ass |
| CVE-2025-48041 |
Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This v |
|
|
erlang (1:27.3+dfsg-1ubuntu1.2) plucky-security; urgency=medium
* SECURITY UPDATE: insufficient strict KEX handshake hardening measures
- debian/patches/CVE-2025-46712-1.patch: add KEX strict implementation
fixes in lib/ssh/src/ssh_connection_handler.erl,
lib/ssh/src/ssh_fsm_kexinit.erl, lib/ssh/src/ssh_transport.erl,
lib/ssh/test/ssh_protocol_SUITE.erl,
lib/ssh/test/ssh_trpt_test_lib.erl.
- debian/patches/CVE-2025-46712-2.patch: add extra remove_handler to
improve robustness in tests in lib/ssh/test/ssh_test_lib.erl.
- CVE-2025-46712
* SECURITY UPDATE: path traversal and other issues in zip
- debian/patches/CVE-2025-4748.patch: properly sanitize filenames when
(un)zipping in lib/stdlib/src/zip.erl, lib/stdlib/test/zip_SUITE.erl.
- CVE-2025-4748
-- Marc Deslauriers <email address hidden> Thu, 10 Jul 2025 10:50:09 -0400
|
| Source diff to previous version |
| CVE-2025-46712 |
Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 (for OTP-27), OTP-26.2.5.12 (for OTP-26), and O |
| CVE-2025-4748 |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (stdlib modules) allows Absolute Path Trav |
|
|
erlang (1:27.3+dfsg-1ubuntu1.1) plucky-security; urgency=medium
* SECURITY UPDATE: Unauthenticated Remote Code Execution in SSH
- debian/patches/CVE-2025-32433.patch: disconnect when connection
protocol message arrives when user is not authenticated for
connection in lib/ssh/src/ssh_connection.erl,
lib/ssh/test/ssh_protocol_SUITE.erl.
- CVE-2025-32433
-- Marc Deslauriers <email address hidden> Wed, 16 Apr 2025 14:14:50 -0400
|
| CVE-2025-32433 |
Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server ma |
|
About
-
Send Feedback to @ubuntu_updates
