UbuntuUpdates.org

Package "erlang"

Name: erlang

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • Erlang/OTP modules for ASN.1 support
  • Erlang/OTP virtual machine and base applications
  • Erlang/OTP cryptographic modules
  • Erlang/OTP development libraries and headers
Latest version: 1:27.3.4.1+dfsg-1ubuntu0.1
Release: questing (25.10)
Level: updates
Repository: main

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "erlang" in Questing

Repository Area Version
base main 1:27.3.4.1+dfsg-1build1
base universe 1:27.3.4.1+dfsg-1build1
security main 1:27.3.4.1+dfsg-1ubuntu0.1
security universe 1:27.3.4.1+dfsg-1ubuntu0.1
updates universe 1:27.3.4.1+dfsg-1ubuntu0.1

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1:27.3.4.1+dfsg-1ubuntu0.1 2025-10-22 01:08:50 UTC

  erlang (1:27.3.4.1+dfsg-1ubuntu0.1) questing-security; urgency=medium

  * SECURITY UPDATE: Increased resource consumption in the SSH module.
    - debian/patches/CVE-2025-48038.patch: Add handle_op for file handle length
      string exceeding 256 bytes in lib/ssh/src/ssh_sftpd.erl.
    - debian/patches/CVE-2025-48039.patch: Add max_path option and limits in
      lib/ssh/src/ssh_sftpd.erl.
    - debian/patches/CVE-2025-48040.patch: Add max_log_len in
      lib/ssh/src/ssh_connection.erl. Add Class:Reason0:Stacktrace for decode
      failures in lib/ssh/src/ssh_connection_handler.erl. Add trim_reason and
      max_log_len in lib/ssh/src/ssh_lib.erl. Change decode_kex_init in
      lib/ssh/src/ssh_message.erl. Change kexinit_error and modify Msg in
      lib/ssh/src/ssh_transport.erl.
    - debian/patches/CVE-2025-48041.patch: Add max_handles option and limits in
      lib/ssh/src/ssh_sftpd.erl.
    - CVE-2025-48038
    - CVE-2025-48039
    - CVE-2025-48040
    - CVE-2025-48041

 -- Hlib Korzhynskyy <email address hidden> Thu, 16 Oct 2025 17:28:35 -0230
CVE-2025-48038 Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Ex
CVE-2025-48039 Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Resource Leak Ex
CVE-2025-48040 Uncontrolled Resource Consumption vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This vulnerability is ass
CVE-2025-48041 Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding. This v


About   -   Send Feedback to @ubuntu_updates