Hi Sergei,
On Tue, Dec 19, 2023 at 12:12:27PM +0300, Sergei Golovan wrote:
> Hi Salvatore,
>
> On Tue, Dec 19, 2023 at 11:24 AM Salvatore Bonaccorso
> wrote:
> >
> > Source: erlang
> > Version: 1:25.2.3+dfsg-1
> > Severity: important
> > Tags: security upstream
> > X-Debbugs-Cc: car...@debian.org, Debian Security Team
> >
> >
> > Hi,
> >
> > The following vulnerability was published for erlang.
> >
> > CVE-2023-48795[0]:
>
> Reading the latest announcement on the Erlang mailing list I've found
> that there is an update of ssh in Erlang 25 which addresses
> CVE-2023-48795:
> https://erlang.org/pipermail/erlang-announce/2023-December/000260.html
>
> I will try to backport these changes to Erlang currently in stable if
> it's necessary. As for the unstable, the newest version will fix this
> as well.
Thanks for working on it. I would say, let's start top-down so go
first trough unstable upload, then we can assess the state for it for
the security supported suites (and if it needs a DSA or can go trough
a point release).
There might be e.g. mitigating factor if ChaCha20-Poly1305 and
Encrypt-then-MAC support is missing.
Regards,
Salvatore
