p PatchFirst

CVE-2025-26618

CVE-2025-26618 · SSH SFTP packet size not verified properly in Erlang OTP

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang. Packet size is not verified properly for SFTP packets. As a result when multiple SSH packets (conforming to max SSH packet size) are received by ssh, they might be combined into an SFTP packet which will exceed the max allowed packet size and potentially cause large amount of memory to be allocated. Note that situation described above can only happen for successfully authenticated users after completing the SSH handshake. This issue has been patched in OTP versions 27.2.4, 26.2.5.9, and 25.3.2.18. There are no known workarounds for this vulnerability.

CVSS 7.0 · Alta · EPSS 0,5% · Corrección disponible

Publicación
Actualización

Pila tecnológica: system

Productos y versiones afectados

  • erlang

    Versiones
    • >= OTP-27.0.0, < OTP-27.2.4: Afectada
    • >= OTP-26.0.0.0, < OTP-26.2.5.9: Afectada
    • < OTP-25.3.2.18: Afectada

    Sin corrección publicada

  • erlang Debian:12

    Versiones
    • 1:25.2.3+dfsg-1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1:25.2.3+dfsg-1+deb12u1

    Actualiza a 1:25.2.3+dfsg-1+deb12u1

  • erlang Debian:13

    Intervalos de versiones afectados
    • ECOSYSTEM: < 1:27.2.4+dfsg-1

    Actualiza a 1:27.2.4+dfsg-1

  • erlang Debian:14

    Intervalos de versiones afectados
    • ECOSYSTEM: < 1:27.2.4+dfsg-1

    Actualiza a 1:27.2.4+dfsg-1

  • erlang Ubuntu:Pro:14.04:LTS

    Versiones
    • 1:16.b.1-dfsg-4ubuntu1
    • 1:16.b.2-dfsg-1ubuntu1
    • 1:16.b.2-dfsg-2ubuntu1
    • 1:16.b.3-dfsg-1ubuntu1
    • 1:16.b.3-dfsg-1ubuntu2
    • 1:16.b.3-dfsg-1ubuntu2.1
    • 1:16.b.3-dfsg-1ubuntu2.2
    • 1:16.b.3-dfsg-1ubuntu2.2+esm1
    • 1:16.b.3-dfsg-1ubuntu2.2+esm2
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1:16.b.3-dfsg-1ubuntu2.2+esm3

    Actualiza a 1:16.b.3-dfsg-1ubuntu2.2+esm3

  • erlang Ubuntu:Pro:16.04:LTS

    Versiones
    • 1:18.0-dfsg-1ubuntu1
    • 1:18.0-dfsg-1ubuntu2
    • 1:18.2-dfsg-2ubuntu1
    • 1:18.3-dfsg-1ubuntu1
    • 1:18.3-dfsg-1ubuntu2
    • 1:18.3-dfsg-1ubuntu3
    • 1:18.3-dfsg-1ubuntu3.1
    • 1:18.3-dfsg-1ubuntu3.1+esm1
    • 1:18.3-dfsg-1ubuntu3.1+esm2
    • 1:18.3-dfsg-1ubuntu3.1+esm3
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1:18.3-dfsg-1ubuntu3.1+esm4

    Actualiza a 1:18.3-dfsg-1ubuntu3.1+esm4

  • erlang Ubuntu:Pro:18.04:LTS

    Versiones
    • 1:20.0.4+dfsg-1ubuntu1
    • 1:20.1.2+dfsg-1ubuntu1
    • 1:20.1.3+dfsg-1ubuntu1
    • 1:20.1.4+dfsg-1ubuntu1
    • 1:20.1.5+dfsg-1ubuntu1
    • 1:20.1.6+dfsg-1ubuntu1
    • 1:20.1.7+dfsg-1ubuntu1
    • 1:20.2.1+dfsg-1ubuntu1
    • 1:20.2.2+dfsg-1ubuntu1
    • 1:20.2.2+dfsg-1ubuntu2
    • 1:20.2.2+dfsg-1ubuntu2+esm1
    • 1:20.2.2+dfsg-1ubuntu2+esm2
    • 1:20.2.2+dfsg-1ubuntu2+esm3
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1:20.2.2+dfsg-1ubuntu2+esm4

    Actualiza a 1:20.2.2+dfsg-1ubuntu2+esm4

  • erlang Ubuntu:20.04:LTS

    Versiones
    • 1:22.0.7+dfsg-1build1
    • 1:22.2+dfsg-1
    • 1:22.2.1+dfsg-1
    • 1:22.2.2+dfsg-1
    • 1:22.2.3+dfsg-1
    • 1:22.2.3+dfsg-2
    • 1:22.2.4+dfsg-1
    • 1:22.2.7+dfsg-1
    • 1:22.2.7+dfsg-1ubuntu0.2
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1:22.2.7+dfsg-1ubuntu0.3

    Actualiza a 1:22.2.7+dfsg-1ubuntu0.3

  • erlang Ubuntu:22.04:LTS

    Versiones
    • 1:23.2.6+dfsg-1build1
    • 1:24.1.1+dfsg-1
    • 1:24.1.4+dfsg-1
    • 1:24.1.5+dfsg-1
    • 1:24.1.5+dfsg-1ubuntu1
    • 1:24.2+dfsg-1
    • 1:24.2.1+dfsg-1
    • 1:24.2.1+dfsg-1ubuntu0.1
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1:24.2.1+dfsg-1ubuntu0.2

    Actualiza a 1:24.2.1+dfsg-1ubuntu0.2

  • erlang Ubuntu:24.04:LTS

    Versiones
    • 1:25.2.3+dfsg-1
    • 1:25.3.2.8+dfsg-1
    • 1:25.3.2.8+dfsg-1ubuntu1
    • 1:25.3.2.8+dfsg-1ubuntu3
    • 1:25.3.2.8+dfsg-1ubuntu4
    Intervalos de versiones afectados
    • ECOSYSTEM: < 1:25.3.2.8+dfsg-1ubuntu4.1

    Actualiza a 1:25.3.2.8+dfsg-1ubuntu4.1

Fuentes originales

Comprueba tu servidor →