Bug#1127607: bookworm-pu: package erlang/1:25.2.3+dfsg-1+deb12u3
Control: tags -1 + confirmed On Tue, 2026-04-07 at 21:14 +0200, Jochen Sprickerhof wrote: > Control: tag -1 - confirmed > > Hi Sergei and Jonathan, > > * Sergei Golovan [2026-04-07 15:06]: > > Since there wasn't any upload of erlang/1:25.2.3+dfsg-1+deb12u4 I'd > > like to add another set of fixes to it. > > I think that makes sense, untagging accordingly. Please go ahead. Regards, Adam
Bug#1127607: bookworm-pu: package erlang/1:25.2.3+dfsg-1+deb12u3
Hi, On Tue, 7 Apr 2026 21:14:03 +0200 Jochen Sprickerhof wrote: > Control: tag -1 - confirmed > > Hi Sergei and Jonathan, > > * Sergei Golovan [2026-04-07 15:06]: > >Since there wasn't any upload of erlang/1:25.2.3+dfsg-1+deb12u4 I'd like to > >add another set of fixes to it. > > I think that makes sense, untagging accordingly. > > @Jonathan: Please say if you still want the old upload. Could we move this forward? Would it be acceptable from the SRM side (Jonathan?) if we proceed with uploading the Erlang version that combines the changes from Jochen and Sergei? Please let us know if you have any concerns. Cheers! Lucas Kanashiro.
Bug#1127607: bookworm-pu: package erlang/1:25.2.3+dfsg-1+deb12u3
Control: tag -1 - confirmed Hi Sergei and Jonathan, * Sergei Golovan [2026-04-07 15:06]: Since there wasn't any upload of erlang/1:25.2.3+dfsg-1+deb12u4 I'd like to add another set of fixes to it. I think that makes sense, untagging accordingly. @Jonathan: Please say if you still want the old upload. Cheers Jochen signature.asc Description: PGP signature
Bug#1127607: bookworm-pu: package erlang/1:25.2.3+dfsg-1+deb12u3
Hi!
Since there wasn't any upload of erlang/1:25.2.3+dfsg-1+deb12u4 I'd like to
add another set of fixes to it.
These are:
CVE-2026-23943 Improper Handling of Highly Compressed Data
(Compression Bomb) in sftpd
CVE-2026-23942 Improper Limitation of a Pathname to a Restricted
Directory in inets
CVE-2026-23941 Inconsistent Interpretation of HTTP Requests in inets
CVE-2026-21620 Improper Limitation of a Pathname to a Restricted
Directory in tftp
See [1] for detail on these CVEs. They are not too scary, but it'd be
better to fix them anyway.
Please, find the updated diff between 1:25.2.3+dfsg-1+deb12u4 and
1:25.2.3+dfsg-1+deb12u3 currently in oldstable.
All the changes come with additional tests, which were successful.
Similar patches were uploaded for trixie recently and for sid and
forky a while ago.
[1] https://security-tracker.debian.org/tracker/source-package/erlang
Cheers!
--
Sergei Golovan
diff -Nru erlang-25.2.3+dfsg/debian/changelog erlang-25.2.3+dfsg/debian/changelog
--- erlang-25.2.3+dfsg/debian/changelog 2025-08-31 13:57:31.0 +0300
+++ erlang-25.2.3+dfsg/debian/changelog 2026-04-07 13:54:55.0 +0300
@@ -1,3 +1,43 @@
+erlang (1:25.2.3+dfsg-1+deb12u4) bookworm; urgency=medium
+
+ [ Jochen Sprickerhof ]
+ * Add salsa-ci
+ * Add gbp.conf.
+Needed to reproduce the orig.tar with empty directories.
+ * Fix CVE-2025-48038: allocation of resources without limits or throttling
+vulnerability in the ssh_sftp module allows excessive allocation,
+resource leak exposure (closes: #1115093).
+ * Fix CVE-2025-48039: allocation of resources without limits or throttling
+vulnerability in the ssh_sftp module allows excessive allocation,
+resource leak exposure (closes: #1115092).
+ * Fix CVE-2025-48040: uncontrolled resource consumption vulnerability in
+the ssh_sftp module allows excessive allocation, flooding (closes: 1115091).
+ * Fix CVE-2025-48041: allocation of resources without limits or throttling
+vulnerability in the ssh_sftp module allows excessive allocation,
+flooding (closes: #1115090).
+
+ [ Lucas Kanashiro ]
+ * Fix CVE-2026-23941.
+Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
+vulnerability in Erlang OTP (inets httpd module) allows HTTP Request
+Smuggling.
+ * Fix CVE-2026-23942.
+Improper Limitation of a Pathname to a Restricted Directory ('Path
+Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path
+Traversal.
+ * Fix CVE-2026-23943.
+Improper Handling of Highly Compressed Data (Compression Bomb)
+vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of
+Service via Resource Depletion.
+Closes: #1130912.
+
+ [ Sergei Golovan ]
+ * Fix CVE-2026-21620.
+Relative Path Traversal, Improper Isolation or Compartmentalization
+vulnerability in Erlang/OTP (tftp_file modules) (closes: 1128651).
+
+ -- Sergei Golovan Tue, 07 Apr 2026 13:54:55 +0300
+
erlang (1:25.2.3+dfsg-1+deb12u3) bookworm-proposed-updates; urgency=medium
* Fix FTBFS with newer xsltproc.
diff -Nru erlang-25.2.3+dfsg/debian/gbp.conf erlang-25.2.3+dfsg/debian/gbp.conf
--- erlang-25.2.3+dfsg/debian/gbp.conf 1970-01-01 03:00:00.0 +0300
+++ erlang-25.2.3+dfsg/debian/gbp.conf 2026-04-07 13:54:55.0 +0300
@@ -0,0 +1,2 @@
+[DEFAULT]
+pristine-tar = True
diff -Nru erlang-25.2.3+dfsg/debian/patches/CVE-2025-48038.patch erlang-25.2.3+dfsg/debian/patches/CVE-2025-48038.patch
--- erlang-25.2.3+dfsg/debian/patches/CVE-2025-48038.patch 1970-01-01 03:00:00.0 +0300
+++ erlang-25.2.3+dfsg/debian/patches/CVE-2025-48038.patch 2026-04-07 13:54:55.0 +0300
@@ -0,0 +1,34 @@
+From: Jakub Witczak
+Date: Wed, 27 Aug 2025 17:49:08 +0200
+Subject: ssh: verify file handle size limit for client data
+
+- reject handles exceeding 256 bytes (as specified for SFTP)
+
+Origin: https://github.com/erlang/otp/commit/f09e0201ff701993dc24a08f15e524daf72db42f
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-48038
+---
+ lib/ssh/src/ssh_sftpd.erl | 11 +++
+ 1 file changed, 11 insertions(+)
+
+diff --git a/lib/ssh/src/ssh_sftpd.erl b/lib/ssh/src/ssh_sftpd.erl
+index 6bcad0d..cd24c3e 100644
+--- a/lib/ssh/src/ssh_sftpd.erl
b/lib/ssh/src/ssh_sftpd.erl
+@@ -222,6 +222,17 @@ handle_data(Type, ChannelId, Data0, State = #state{pending = Pending}) ->
+ handle_data(Type, ChannelId, Data, State#state{pending = <<>>})
+ end.
+
++%% From draft-ietf-secsh-filexfer-02 "The file handle strings MUST NOT be longer than 256 bytes."
++handle_op(Request, ReqId, <>, State = #state{xf = XF})
++ when (Request == ?SSH_FXP_CLOSE orelse
++Request == ?SSH_FXP_FSETSTAT orelse
++Request == ?SSH_FXP_FSTAT orelse
++Request == ?SSH_FXP_READ orelse
++Request == ?SSH_FXP_READDIR orelse
++Request == ?SSH_FXP_WRITE),
++ HLen > 256 ->
++ssh_xfer:xf_send_status(XF, ReqId, ?SSH_FX_INVALID_HANDLE, "Invali
Bug#1127607: bookworm-pu: package erlang/1:25.2.3+dfsg-1+deb12u3
Control: tag -1 confirmed Hi, Please go ahead. Thanks, -- Jonathan Wiltshire [email protected] Debian Developer http://people.debian.org/~jmw 4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC 74C3 5394 479D D352 4C51 ed25519/0x196418AAEB74C8A1: CA619D65A72A7BADFC96D280196418AAEB74C8A1
Bug#1127607: bookworm-pu: package erlang/1:25.2.3+dfsg-1+deb12u3
Package: release.debian.org Severity: normal Tags: bookworm X-Debbugs-Cc: [email protected], Sergei Golovan , Bastien Roucaries Control: affects -1 + src:erlang User: [email protected] Usertags: pu [ Reason ] There have been several CVEs published for the erlang programming language that have been flagged as no DSA affecting the ssh server implementation. [ Impact ] Mostly denial of service attacks. [ Tests ] Manually tested. [ Risks ] Low risk, given that those implementations are niche and the patches mostly add safe guards. [ Checklist ] [X] *all* changes are documented in the d/changelog [X] I reviewed all changes and I approve them [X] attach debdiff against the package in (old)stable [X] the issue is verified as fixed in unstable [ Other info ] @Sergei as with #1127606 (trixie) please write if you disagree. diff --git a/debian/changelog b/debian/changelog index 6738cb3c3a..b6b3272c74 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,20 @@ +erlang (1:25.2.3+dfsg-1+deb12u4) bookworm; urgency=medium + + * Non-maintainer upload. + * Fix CVE-2025-48038: allocation of resources without limits or throttling +vulnerability in the ssh_sftp module allows excessive allocation, +resource leak exposure (closes: #1115093). + * Fix CVE-2025-48039: allocation of resources without limits or throttling +vulnerability in the ssh_sftp module allows excessive allocation, +resource leak exposure (closes: #1115092). + * Fix CVE-2025-48040: uncontrolled resource consumption vulnerability in +the ssh_sftp module allows excessive allocation, flooding (closes: 1115091). + * Fix CVE-2025-48041: allocation of resources without limits or throttling +vulnerability in the ssh_sftp module allows excessive allocation, +flooding (closes: #1115090). + + -- Jochen Sprickerhof Thu, 15 Jan 2026 10:56:30 +0100 + erlang (1:25.2.3+dfsg-1+deb12u3) bookworm-proposed-updates; urgency=medium * Fix FTBFS with newer xsltproc. diff --git a/debian/gbp.conf b/debian/gbp.conf new file mode 100644 index 00..cec628c744 --- /dev/null +++ b/debian/gbp.conf @@ -0,0 +1,2 @@ +[DEFAULT] +pristine-tar = True diff --git a/debian/patches/CVE-2025-48038.patch b/debian/patches/CVE-2025-48038.patch new file mode 100644 index 00..800160e857 --- /dev/null +++ b/debian/patches/CVE-2025-48038.patch @@ -0,0 +1,34 @@ +From: Jakub Witczak +Date: Wed, 27 Aug 2025 17:49:08 +0200 +Subject: ssh: verify file handle size limit for client data + +- reject handles exceeding 256 bytes (as specified for SFTP) + +Origin: https://github.com/erlang/otp/commit/f09e0201ff701993dc24a08f15e524daf72db42f +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-48038 +--- + lib/ssh/src/ssh_sftpd.erl | 11 +++ + 1 file changed, 11 insertions(+) + +diff --git a/lib/ssh/src/ssh_sftpd.erl b/lib/ssh/src/ssh_sftpd.erl +index 6bcad0d..cd24c3e 100644 +--- a/lib/ssh/src/ssh_sftpd.erl b/lib/ssh/src/ssh_sftpd.erl +@@ -222,6 +222,17 @@ handle_data(Type, ChannelId, Data0, State = #state{pending = Pending}) -> + handle_data(Type, ChannelId, Data, State#state{pending = <<>>}) + end. + ++%% From draft-ietf-secsh-filexfer-02 "The file handle strings MUST NOT be longer than 256 bytes." ++handle_op(Request, ReqId, <>, State = #state{xf = XF}) ++ when (Request == ?SSH_FXP_CLOSE orelse ++Request == ?SSH_FXP_FSETSTAT orelse ++Request == ?SSH_FXP_FSTAT orelse ++Request == ?SSH_FXP_READ orelse ++Request == ?SSH_FXP_READDIR orelse ++Request == ?SSH_FXP_WRITE), ++ HLen > 256 -> ++ssh_xfer:xf_send_status(XF, ReqId, ?SSH_FX_INVALID_HANDLE, "Invalid handle"), ++State; + handle_op(?SSH_FXP_INIT, Version, B, State) when is_binary(B) -> + XF = State#state.xf, + Vsn = lists:min([XF#ssh_xfer.vsn, Version]), diff --git a/debian/patches/CVE-2025-48039.patch b/debian/patches/CVE-2025-48039.patch new file mode 100644 index 00..a683c023c0 --- /dev/null +++ b/debian/patches/CVE-2025-48039.patch @@ -0,0 +1,239 @@ +From: Jakub Witczak +Date: Fri, 11 Jul 2025 13:59:41 +0200 +Subject: ssh: ssh_sftpd verify path size for client data + +- reject max_path exceeding the 4096 limit or according to other option value + +Origin: https://github.com/erlang/otp/commit/043ee3c943e2977c1acdd740ad13992fd60b6bf0 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2025-48039 +--- + lib/ssh/doc/src/ssh_sftpd.xml| 8 + lib/ssh/src/ssh_sftpd.erl| 32 +- + lib/ssh/test/ssh_sftpd_SUITE.erl | 90 ++-- + 3 files changed, 97 insertions(+), 33 deletions(-) + +diff --git a/lib/ssh/doc/src/ssh_sftpd.xml b/lib/ssh/doc/src/ssh_sftpd.xml +index 49a23f4..efabf3f 100644 +--- a/lib/ssh/doc/src/ssh_sftpd.xml b/lib/ssh/doc/src/ssh_sftpd.xml +@@ -65,6 +65,14 @@ + If supplied, the number of filenames returned to the SFTP client per
