[ubuntu/resolute-security] erlang 1:27.3.4.6+dfsg-1ubuntu0.2 (Accepted)

John Breton john.breton at canonical.com
Thu Oct 8 00:18:41 UTC 2026 

erlang (1:27.3.4.6+dfsg-1ubuntu0.2) resolute-security; urgency=medium

  * SECURITY UPDATE: Path Traversal
    - debian/patches/CVE-2026-21620-1.patch: Validate initial options in
      lib/tftp/src/tftp_file.erl.
    - debian/patches/CVE-2026-21620-2.patch: Rewrite old style catch in
      lib/tftp/src/tftp_file.erl.
    - debian/patches/CVE-2026-21620-3.patch: Fix typos in
      lib/tftp/src/tftp_file.erl.
    - debian/patches/CVE-2026-21620-4.patch: Fix an incorrect type and a few
      bugs in lib/tftp/src/tftp_file.erl.
    - CVE-2026-21620
  * SECURITY UPDATE: Path Traversal
    - debian/patches/CVE-2026-23942.patch: ssh: Fix path traversal vulnerability
      in ssh_sftpd root directory validation in lib/ssh/doc/guides/hardening.md,
      lib/ssh/src/ssh_sftpd.erl, lib/ssh/test/ssh_sftpd_SUITE.erl.
    - CVE-2026-23942
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-23943.patch: Disable zlib by default and limit
      size of decompressed data in lib/ssh/src/ssh_connection_handler.erl,
      lib/ssh/src/ssh_transport.erl.
    - CVE-2026-23943
  * SECURITY UPDATE: Authentication Bypass
    - debian/patches/CVE-2026-28808.patch: inets: Check script_alias when using
      mod_auth in lib/inets/src/http_server/httpd.erl,
      lib/inets/src/http_server/mod_alias.erl, lib/inets/test/httpd_SUITE.erl.
    - CVE-2026-28808
  * SECURITY UPDATE: DNS Cache Poisoning
    - debian/patches/CVE-2026-28810-1.patch: Randomize `inet_res` transaction ID
      and source port number in lib/kernel/src/gen_udp.erl,
      lib/kernel/src/inet.erl, lib/kernel/src/inet6_udp.erl,
      lib/kernel/src/inet_db.erl, lib/kernel/src/inet_dns.erl,
      lib/kernel/src/inet_res.erl, lib/kernel/src/inet_udp.erl,
      lib/kernel/test/inet_res_SUITE.erl.
    - debian/patches/CVE-2026-28810-2.patch: Update after feedback in
      lib/kernel/src/gen_udp.erl, lib/kernel/src/inet.erl,
      lib/kernel/src/inet6_sctp.erl, lib/kernel/src/inet_db.erl,
      lib/kernel/src/inet_dns.erl, lib/kernel/src/inet_res.erl,
      lib/kernel/src/inet_sctp.erl.
    - debian/patches/CVE-2026-28810-3.patch: Fix handling of truncation bit vs.
      truncated sections in lib/kernel/src/inet_dns.erl,
      lib/kernel/src/inet_res.erl, lib/kernel/test/inet_res_SUITE.erl,
      lib/kernel/test/inet_res_SUITE_data/otptest/otptest.zone.
    - debian/patches/CVE-2026-28810-4.patch: Do not drop random mode after
      getting econnrefused in lib/kernel/src/inet_res.erl.
    - CVE-2026-28810
  * SECURITY UPDATE: Authorization Bypass
    - debian/patches/CVE-2026-32144.patch: public_key: Verify designated OCSP
      responder certificate signature in lib/public_key/src/pubkey_ocsp.erl,
      lib/public_key/test/pubkey_ocsp_SUITE.erl.
    - CVE-2026-32144
  * SECURITY UPDATE: Path Traversal
    - debian/patches/CVE-2026-32147.patch: Fix root escape vulnerability in
      SSH_FXP_FSETSTAT in lib/ssh/src/ssh_sftpd.erl.
    - CVE-2026-32147
  * SECURITY UPDATE: Certificate Validation Bypass
    - debian/patches/CVE-2026-42789.patch: public_key: Update to stricter check
      as clearly defined in RFC 5280 in lib/public_key/src/pubkey_cert.erl,
      lib/public_key/test/public_key_SUITE.erl.
    - CVE-2026-42789
  * SECURITY UPDATE: Certificate Validation Bypass
    - debian/patches/CVE-2026-42790-1.patch: public_key: Adhere to RFC 9525 in
      lib/public_key/src/public_key.erl,
      lib/public_key/test/public_key_SUITE.erl.
    - debian/patches/CVE-2026-42790-2.patch: public_key: Add new error in
      lib/public_key/src/pubkey_cert.erl, lib/public_key/src/public_key.erl,
      lib/public_key/test/pkits_SUITE.erl.
    - debian/patches/CVE-2026-42790-3.patch: ssl: Improve error handling due to
      public_key updates. in lib/ssl/src/ssl_handshake.erl,
      lib/ssl/test/ssl_api_SUITE.erl, lib/ssl/test/ssl_cert_tests.erl,
      lib/ssl/test/ssl_sni_SUITE.erl.
    - debian/patches/CVE-2026-42790-4.patch: Fix spelling of
      distinguished_name_not_permitted atom in lib/ssl/src/ssl_handshake.erl.
    - CVE-2026-42790
  * SECURITY UPDATE: Certificate Validation Bypass
    - debian/patches/CVE-2026-42791.patch: public_key: Validate OCSP responder
      certificate validity period in lib/public_key/src/pubkey_cert.erl,
      lib/public_key/src/pubkey_ocsp.erl,
      lib/public_key/test/pubkey_ocsp_SUITE.erl.
    - CVE-2026-42791
  * SECURITY UPDATE: Information Disclosure
    - debian/patches/CVE-2026-48855.patch: Fix absolute path leak from
      SSH_FXP_READLINK in lib/ssh/src/ssh_sftpd.erl.
    - CVE-2026-48855
  * SECURITY UPDATE: Information Disclosure
    - debian/patches/CVE-2026-48856.patch: inets/httpc: strip sensitive headers
      on cross-origin redirect in lib/inets/src/http_client/httpc_response.erl,
      lib/inets/test/httpc_SUITE.erl.
    - CVE-2026-48856
  * SECURITY UPDATE: Server-Side Request Forgery
    - debian/patches/CVE-2026-48858.patch: ftp: validate PASV response IP
      against control connection peer in lib/ftp/src/ftp_internal.erl,
      lib/ftp/test/ftp_SUITE.erl.
    - CVE-2026-48858
  * SECURITY UPDATE: Access Control Bypass
    - debian/patches/CVE-2026-48860.patch: ssl: Correct function used to check
      peer IP in lib/ssl/src/inet_tls_dist.erl.
    - CVE-2026-48860
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-49759-1.patch: Protect the output term buffer from
      overflow in erts/emulator/drivers/common/inet_drv.c.
    - debian/patches/CVE-2026-49759-2.patch: Rewrite error parse loop to handle
      all lengths in erts/emulator/drivers/common/inet_drv.c.
    - CVE-2026-49759
  * SECURITY UPDATE: Buffer Overflow
    - debian/patches/CVE-2026-49760.patch: erl_interface: Fix stack overflow in
      ei_s_print_term in lib/erl_interface/src/misc/ei_printterm.c,
      lib/erl_interface/test/ei_print_SUITE_data/ei_print_test.c.
    - CVE-2026-49760
  * SECURITY UPDATE: Information Disclosure
    - debian/patches/CVE-2026-53422.patch: Fix realpath path existence oracle in
      lib/ssh/src/ssh_sftpd.erl.
    - CVE-2026-53422
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-54886.patch: Fix extended data infinite loop in
      sftpd in lib/ssh/src/ssh_sftpd.erl, lib/ssh/test/ssh_sftpd_SUITE.erl.
    - CVE-2026-54886
  * SECURITY UPDATE: Security Bypass
    - debian/patches/CVE-2026-54887.patch: ssl: Avoid cookie forgery during
      setup up window in lib/ssl/src/dtls_server_connection.erl.
    - CVE-2026-54887
  * SECURITY UPDATE: Plaintext Injection
    - debian/patches/CVE-2026-54891.patch: ssl: TLS Client hardening in
      lib/ssl/src/tls_gen_connection.erl.
    - CVE-2026-54891
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-55950.patch: ssl: Fix DTLS race condition in
      lib/ssl/src/dtls_packet_demux.erl.
    - CVE-2026-55950
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-55952.patch: ssl: Add PSK parameter check in
      lib/ssl/src/tls_handshake_1_3.erl.
    - CVE-2026-55952
  * SECURITY UPDATE: Path Traversal
    - debian/patches/CVE-2026-47078.patch: zip: Fix relative path traversal
      checking in lib/stdlib/src/zip.erl.
    - CVE-2026-47078
  * SECURITY UPDATE: Authentication Bypass
    - debian/patches/CVE-2026-74994.patch: inets: Fix per-directory auth
      namespace isolation for dets/mnesia in
      lib/inets/src/http_server/mod_auth.erl,
      lib/inets/src/http_server/mod_auth_server.erl,
      lib/inets/test/httpd_SUITE.erl.
    - CVE-2026-74994
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-65634.patch: asn1: Mitigate a DoS vector in
      lib/asn1/src/asn1rtt_ber.erl, lib/asn1/src/asn1rtt_jer.erl,
      lib/asn1/src/asn1rtt_per_common.erl, lib/asn1/test/testPrim.erl.
    - CVE-2026-65634
  * SECURITY UPDATE: Denial of Service
    - debian/patches/CVE-2026-68956-1.patch: ssh: Limit size of channel cache
      entries in lib/ssh/src/ssh.hrl, lib/ssh/src/ssh_channel_sup.erl,
      lib/ssh/src/ssh_client_channel.erl, lib/ssh/src/ssh_connection.erl,
      lib/ssh/src/ssh_connection_handler.erl,
      lib/ssh/src/ssh_connection_sup.erl,
      lib/ssh/src/ssh_tcpip_forward_acceptor.erl,
      lib/ssh/test/ssh_connection_SUITE.erl, lib/ssh/test/ssh_options_SUITE.erl.
    - debian/patches/CVE-2026-68956-2.patch: ssh: Change max_sessions and
      max_channels defaults and update terminology in
      lib/ssh/doc/guides/hardening.md, lib/ssh/doc/guides/terminology.md,
      lib/ssh/src/ssh.hrl, lib/ssh/src/ssh_options.erl,
      lib/ssh/test/ssh_options_SUITE.erl.
    - debian/patches/CVE-2026-68956-3.patch: ssh: Don't close connection when
      port forward channel limit is reached in lib/ssh/src/ssh_connection.erl,
      lib/ssh/src/ssh_connection_handler.erl,
      lib/ssh/test/ssh_connection_SUITE.erl.
    - CVE-2026-68956
  * SECURITY UPDATE: Server Impersonation
    - debian/patches/CVE-2026-89422.patch: ssl: Reject unsolicited TLS-1.3
      pre_shared_key in client in lib/ssl/src/tls_client_connection_1_3.erl,
      lib/ssl/src/tls_handshake_1_3.erl.
    - CVE-2026-89422

Date: 2026-10-07 15:49:54.324772+00:00
Changed-By: John Breton <john.breton at canonical.com>
https://launchpad.net/ubuntu/+source/erlang/1:27.3.4.6+dfsg-1ubuntu0.2
-------------- next part --------------
Sorry, changesfile not available.

More information about the Resolute-changes mailing list