[DSA 6464-1] erlang security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian Security Advisory DSA-6464-1                   [email protected]
https://www.debian.org/security/                                  Aron Xu
August 25, 2026                       https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : erlang
CVE ID         : CVE-2026-28808 CVE-2026-28810 CVE-2026-32144 CVE-2026-32147 
                 CVE-2026-42789 CVE-2026-42790 CVE-2026-42791 CVE-2026-42792 
                 CVE-2026-47078 CVE-2026-48855 CVE-2026-48856 CVE-2026-48858 
                 CVE-2026-48860 CVE-2026-49759 CVE-2026-49760 CVE-2026-53422 
                 CVE-2026-54886 CVE-2026-54887 CVE-2026-54890 CVE-2026-54891 
                 CVE-2026-55737 CVE-2026-55950 CVE-2026-55952 CVE-2026-55953 
                 CVE-2026-58227 CVE-2026-59250 CVE-2026-59251
Debian Bug     : 1139727 1139823 1141414 1142985

Multiple vulnerabilities were discovered in Erlang/OTP, a concurrent,
real-time, distributed functional language, which may result in denial of
service, information disclosure, authentication and certificate validation
bypass, or the execution of arbitrary code. These vulnerbilities affect a
wide range of components: TLS and certificate validation (ssl, public_key),
SSH (ssh), network clients and servers (inets, ftp, epmd, kernel),
runtime and libraries (erts, erl_interface, stdlib, megaco).

Several of these fixes tighten checks that were previously too permissive,
and can cause configurations that worked before to stop working. The most
likely to be noticed are:

 - TLS clients using verify_peer, which is the default, now reject
   certificates that carry no subjectAltName extension; the
   customize_hostname_check option does not restore the old behaviour.

 - Erlang distribution over TLS with the kernel 'check_ip' option now
   enforces the check that was previously a no-op, so clusters whose nodes
   are not on the same subnet lose distribution connectivity until the
   option is unset.

 - TLS clients that request OCSP stapling now fail the handshake when the
   server provides no stapled response.

 - Clients using TLS 1.2 or earlier now abort the handshake if the server
   sends an ALPN extension that the client did not advertise.

 - DNS queries made through inet_res now use randomised source ports

For the stable distribution (trixie), these problems have been fixed in
version 1:27.3.4.1+dfsg-1+deb13u3.

We recommend that you upgrade your erlang packages.

For the detailed security status of erlang please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/erlang

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: [email protected]
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqNGTgACgkQ+GQ1dHE8
m67r5gf/XVEBYkHI0vk4FMUXrjsUwYbL+hHl0QMXfnew46Hb6GjffjIzBV3IRia0
A8mGRowYJYJFAZwlUDwkAXM66FZ+vrRK7lM+rW27DY1TNkf59xNcV2BTdjDs8DD1
nNmSqnBAJcCf59Lw2PesocCRqp31SYMN4OlMF+t9DK4hwJ1tuC4AALaMCUBWKwPN
QmaQvLk1SmNnW9vyCHTuUEAxHGqm3moBEV7rHYIPHLDWzCQNfkJlOwLb/aWhWywR
83FaXax/2l9phuSGO9gna9xDgzvauK2QliwNSxuO5ON4K6+xlYfxyEjTf8/YGM50
9Z/6F83Z9OBi/MVhJtog4uEFem3wqw==
=0ypR
-----END PGP SIGNATURE-----