-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6464-1 [email protected]
https://www.debian.org/security/ Aron Xu
August 25, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : erlang
CVE ID : CVE-2026-28808 CVE-2026-28810 CVE-2026-32144 CVE-2026-32147
CVE-2026-42789 CVE-2026-42790 CVE-2026-42791 CVE-2026-42792
CVE-2026-47078 CVE-2026-48855 CVE-2026-48856 CVE-2026-48858
CVE-2026-48860 CVE-2026-49759 CVE-2026-49760 CVE-2026-53422
CVE-2026-54886 CVE-2026-54887 CVE-2026-54890 CVE-2026-54891
CVE-2026-55737 CVE-2026-55950 CVE-2026-55952 CVE-2026-55953
CVE-2026-58227 CVE-2026-59250 CVE-2026-59251
Debian Bug : 1139727 1139823 1141414 1142985
Multiple vulnerabilities were discovered in Erlang/OTP, a concurrent,
real-time, distributed functional language, which may result in denial of
service, information disclosure, authentication and certificate validation
bypass, or the execution of arbitrary code. These vulnerbilities affect a
wide range of components: TLS and certificate validation (ssl, public_key),
SSH (ssh), network clients and servers (inets, ftp, epmd, kernel),
runtime and libraries (erts, erl_interface, stdlib, megaco).
Several of these fixes tighten checks that were previously too permissive,
and can cause configurations that worked before to stop working. The most
likely to be noticed are:
- TLS clients using verify_peer, which is the default, now reject
certificates that carry no subjectAltName extension; the
customize_hostname_check option does not restore the old behaviour.
- Erlang distribution over TLS with the kernel 'check_ip' option now
enforces the check that was previously a no-op, so clusters whose nodes
are not on the same subnet lose distribution connectivity until the
option is unset.
- TLS clients that request OCSP stapling now fail the handshake when the
server provides no stapled response.
- Clients using TLS 1.2 or earlier now abort the handshake if the server
sends an ALPN extension that the client did not advertise.
- DNS queries made through inet_res now use randomised source ports
For the stable distribution (trixie), these problems have been fixed in
version 1:27.3.4.1+dfsg-1+deb13u3.
We recommend that you upgrade your erlang packages.
For the detailed security status of erlang please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/erlang
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: [email protected]
-----BEGIN PGP SIGNATURE-----
iQEzBAEBCAAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqNGTgACgkQ+GQ1dHE8
m67r5gf/XVEBYkHI0vk4FMUXrjsUwYbL+hHl0QMXfnew46Hb6GjffjIzBV3IRia0
A8mGRowYJYJFAZwlUDwkAXM66FZ+vrRK7lM+rW27DY1TNkf59xNcV2BTdjDs8DD1
nNmSqnBAJcCf59Lw2PesocCRqp31SYMN4OlMF+t9DK4hwJ1tuC4AALaMCUBWKwPN
QmaQvLk1SmNnW9vyCHTuUEAxHGqm3moBEV7rHYIPHLDWzCQNfkJlOwLb/aWhWywR
83FaXax/2l9phuSGO9gna9xDgzvauK2QliwNSxuO5ON4K6+xlYfxyEjTf8/YGM50
9Z/6F83Z9OBi/MVhJtog4uEFem3wqw==
=0ypR
-----END PGP SIGNATURE-----
