Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #1261189 > unrolled thread
| Started by | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| First post | 2025-09-13 12:40 +0200 |
| Last post | 2025-09-16 10:20 +0200 |
| Articles | 3 — 2 participants |
Back to article view | Back to linux.debian.bugs.dist
Bug#1115093: erlang: CVE-2025-48038 Salvatore Bonaccorso <carnil@debian.org> - 2025-09-13 12:40 +0200
Bug#1115093: [Pkg-erlang-devel] Bug#1115093: erlang: CVE-2025-48038 Sergei Golovan <sgolovan@gmail.com> - 2025-09-16 09:50 +0200
Bug#1115093: [Pkg-erlang-devel] Bug#1115093: erlang: CVE-2025-48038 Salvatore Bonaccorso <carnil@debian.org> - 2025-09-16 10:20 +0200
| From | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| Date | 2025-09-13 12:40 +0200 |
| Subject | Bug#1115093: erlang: CVE-2025-48038 |
| Message-ID | <LuvPH-eZ9O-13@gated-at.bofh.it> |
Source: erlang
Version: 1:27.3.4.1+dfsg-1
Severity: important
Tags: security upstream
Forwarded: https://github.com/erlang/otp/pull/10156
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>
Hi,
The following vulnerability was published for erlang.
CVE-2025-48038[0]:
| Allocation of Resources Without Limits or Throttling vulnerability
| in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation,
| Resource Leak Exposure. This vulnerability is associated with
| program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP
| form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15
| corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2025-48038
https://www.cve.org/CVERecord?id=CVE-2025-48038
[1] https://github.com/erlang/otp/pull/10156
[2] https://github.com/erlang/otp/security/advisories/GHSA-pvj7-9652-7h9r
[3] https://github.com/erlang/otp/commit/4e3bf86777ab3db7220c11d8ddabf15970ddd10a
[4] https://github.com/erlang/otp/commit/f09e0201ff701993dc24a08f15e524daf72db42f
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
[toc] | [next] | [standalone]
| From | Sergei Golovan <sgolovan@gmail.com> |
|---|---|
| Date | 2025-09-16 09:50 +0200 |
| Subject | Bug#1115093: [Pkg-erlang-devel] Bug#1115093: erlang: CVE-2025-48038 |
| Message-ID | <LvyBP-fHCA-5@gated-at.bofh.it> |
| In reply to | #1261189 |
Hi Salvatore, On Sat, Sep 13, 2025 at 1:39 PM Salvatore Bonaccorso <carnil@debian.org> wrote: > > Hi, > > The following vulnerability was published for erlang. > > CVE-2025-48038[0]: > | Allocation of Resources Without Limits or Throttling vulnerability > | in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, > | Resource Leak Exposure. This vulnerability is associated with > | program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP > | form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 > | corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12. I have uploaded the latest upstream versions with fixes to all five reported CVEs to unstable and experimental. Now I'd like to backport the fixes to trixie and bookworm as well. Do you think the CVEs are serious enough to warrant DSA? Or I'll just upload them to the proposed-updates suits (with suitable bugreports to the release.debian.org pseudopackage)? Cheers! -- Sergei Golovan
[toc] | [prev] | [next] | [standalone]
| From | Salvatore Bonaccorso <carnil@debian.org> |
|---|---|
| Date | 2025-09-16 10:20 +0200 |
| Subject | Bug#1115093: [Pkg-erlang-devel] Bug#1115093: erlang: CVE-2025-48038 |
| Message-ID | <Lvz4S-fI3U-7@gated-at.bofh.it> |
| In reply to | #1261651 |
Hi Sergei, On Tue, Sep 16, 2025 at 10:17:59AM +0300, Sergei Golovan wrote: > Hi Salvatore, > > On Sat, Sep 13, 2025 at 1:39 PM Salvatore Bonaccorso <carnil@debian.org> wrote: > > > > Hi, > > > > The following vulnerability was published for erlang. > > > > CVE-2025-48038[0]: > > | Allocation of Resources Without Limits or Throttling vulnerability > > | in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, > > | Resource Leak Exposure. This vulnerability is associated with > > | program files lib/ssh/src/ssh_sftpd.erl. This issue affects OTP > > | form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 > > | corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12. > > I have uploaded the latest upstream versions with fixes to all five > reported CVEs > to unstable and experimental. > > Now I'd like to backport the fixes to trixie and bookworm as well. Do > you think the CVEs > are serious enough to warrant DSA? Or I'll just upload them to the > proposed-updates suits > (with suitable bugreports to the release.debian.org pseudopackage)? Thanks for reaching out and having fixed the issues already in unstable and experimental! We think a point release update should be enough for those issues, can you contact the SRM accordingly? Thanks a lot as well for taking care of fixing the issues in trixie and bookworm. Regards, Salvatore
[toc] | [prev] | [standalone]
Back to top | Article view | linux.debian.bugs.dist
csiph-web