Jakub Witczak

The TLS 1.2 (and earlier) and DTLS client fails to verify if the cipher suite selected by the server in the ServerHello message was actually offered by the client in the ClientHello message. The `tls handshake:hello/5` handler validates the protocol version and downgrade sentinel but passes the server-chosen suite to `ssl handshake:handle server hello extensions/9` without a membership check. An on-path attacker can force the use of anonymous key exchange suites, such as `TLS DH anon *` or `TLS ECDH anon *`, which do not require server certificates. This bypasses the `verify peer` and `cacerts` configurations, allowing the attacker to complete the handshake without certificate or hostname validation, making all subsequent application traffic readable and modifiable.

A buffer overflow exists in the megaco flex scanner C driver. A remote unauthenticated attacker can corrupt the driver's memory by sending a text-encoded H.248/Megaco message containing an oversized property parm name. During the tokenization of a Local/Remote descriptor, the `mfs load property groups()` function extracts the property name and formats it into a fixed 512-byte `error msg` field of the `MfsErlDrvData` struct using an unchecked `sprintf` call. Names exceeding approximately 452 bytes overflow into adjacent struct fields, including `text buf`, `text ptr`, `term spec`, `term spec size`, and `term spec index`. This allows the attacker to overwrite pointers and counters, potentially leading to arbitrary write and free primitives within the BEAM VM process, which can result in remote code execution. On builds compiled with ` FORTIFY SOURCE`, the overflow triggers a SIGABRT, causing a denial of service. The issue occurs before authentication processing and requires the node to be configured with `{scanner, flex}`.

Resource allocation without limits in the certificate path validation of the public key module allows a remote unauthenticated attacker to cause a denial of service. By sending a crafted X.509 certificate chain during a TLS handshake, an attacker can trigger unbounded growth of the certificate policy tree during RFC 5280 policy processing in the `pkix path validation/3` function. This occurs because the functions `pubkey policy tree:add leaves/2` and `pubkey policy tree:add leaf siblings/2` extend the tree per policy per certificate, leading to exponential growth. This can pin BEAM schedulers and exhaust node memory, resulting in a complete virtual machine crash. The issue affects any incoming or outgoing TLS connection that validates the peer's chain, such as SSL/TLS clients and mutual-TLS servers.

The ssl application fails to detect cycles when reconstructing an incomplete peer certificate chain during a TLS or DTLS handshake. Specifically, the function `handle incomplete chain/5` passes the chain to `build certificate chain/5`, which then uses `do certificate chain/7` to walk issuer relationships without a depth limit or cycle detection. If a peer provides two mutually cross-signed certificates in an unordered form, the system recurses indefinitely, causing the call stack and chain accumulator to grow without bound. An unauthenticated remote attacker can exploit this by sending a crafted certificate chain in a handshake message to exhaust memory and crash the BEAM node. This affects both servers and clients and requires only a TCP connection and a partial handshake.

The ssl application fails to validate that the PSK identity list and binder list in a TLS 1.3 ClientHello pre-shared key extension have equal length. In the function `handle pre shared key/3`, an `OfferedPreSharedKeys` record with mismatched lengths is passed to `use/4`, causing the session ticket handler process to crash. An unauthenticated remote attacker can send a crafted ClientHello to a TLS 1.3 server with session tickets enabled to disrupt session ticket handling. While new TLS 1.3 handshakes may complete, they crash when the server attempts to issue a session ticket, rendering TLS 1.3 unusable on the listener until the application is restarted. TLS 1.2 connections are not affected.

Improper enforcement of message integrity during transmission in the `tls gen connection` module allows a network-positioned attacker to inject unauthenticated plaintext that the TLS client application later treats as authenticated server data. The function `handle protocol record()` fails to reject APPLICATION DATA records that arrive in pre-handshake states when the endpoint acts as a client. An attacker can send plaintext APPLICATION DATA records during the handshake, which are buffered and delivered to the application as authenticated post-handshake data once the handshake completes. This results in the blind injection of unauthenticated bytes. The injection window is wider for TLS versions prior to TLS 1.3 than for TLS 1.3.

An infinite loop exists in the `ssh sftpd` module of Erlang OTP. An authenticated SFTP user can cause an SFTP channel to become permanently unresponsive by sending `SSH MSG CHANNEL EXTENDED DATA` with a non-zero type code, an empty pending buffer, and a payload within the SFTP packet size limit. This triggers a tail-recursive loop in the `handle data()` function, causing the process to stop processing messages and leading to unbounded message queue memory growth and high CPU consumption. The impact is a denial of service on targeted SFTP channels. This effect can be amplified if the `max channels` setting is set to infinity, allowing a single user to open unlimited channels.

An observable response discrepancy in the `ssh sftpd` module allows an authenticated SFTP user to enumerate files and directories outside the configured root directory. The `SSH FXP REALPATH` handler calls `relate file name/3` with `Canonicalize=false`, which allows path traversal components to bypass the `is within root/2` check. The path then enters `resolve symlinks/2`, which performs `read link()` syscalls on arbitrary filesystem paths. An attacker can use a crafted traversal path in a REALPATH request to create a path-existence oracle, as the server returns `SSH FXP NAME` if the path exists and `SSH FX NO SUCH FILE` if it does not. This issue is associated with the file `lib/ssh/src/ssh sftpd.erl` and the function `ssh sftpd:handle op/4`. This flaw only leaks the existence of paths and does not provide access to file contents or credentials.

An issue in the `inet tls dist` module allows an unauthenticated bypass of the LAN allowlist for Erlang distribution over TLS. The `check ip()` function incorrectly calls `sockname()` instead of `peername()` to retrieve the peer's IP address. Since `sockname()` returns the local socket address, the subnet mask comparison always succeeds regardless of the actual remote address. Consequently, any holder of a CA-signed TLS certificate can bypass LAN restrictions and gain full distribution access to the node, including the ability to use `rpc:call()` and `code:load binary()` functions.

An issue in the `ssh sftpd` module allows for file discovery through the exposure of sensitive information. The `SSH FXP READLINK` handler sends the raw result of the `file:read link/2` function to the client without using `chroot filename/2` to remove the backend root prefix. Consequently, an authenticated SFTP client can create a symlink inside the chroot pointing to `/`, and reading it back via `SSH FXP READLINK` returns the absolute backend root path (e.g., `/data/sftp`) instead of the chrooted value `/`. This discloses the absolute filesystem path of the SFTP root directory and any symlink targets within it, although file contents, credentials, and paths outside the root directory remain inaccessible. This issue is associated with the file `lib/ssh/src/ssh sftpd.erl` and requires the SFTP subsystem to be enabled with the `root` option configured in the `ssh sftpd:subsystem spec/1` call.

A timing side-channel in password authentication allows unauthenticated remote attackers to enumerate usernames. When the SSH daemon is configured with the `user passwords` or `password` option, the `check password/3()` function in the `ssh auth` module performs a PBKDF2-SHA256 computation for valid usernames, taking approximately 300ms. Conversely, for invalid usernames, the `get password option/2()` function in the `ssh options` module returns immediately. This discrepancy allows an attacker to distinguish between valid and invalid usernames in a single attempt.

Improper certificate validation in the `pubkey cert` and `public key` modules allows a DNS nameConstraints bypass during TLS hostname verification. This occurs because `pubkey cert:validate names/6` only checks Subject Alternative Name (SAN) DNS entries against nameConstraints, meaning certificates without a SAN trivially satisfy permitted DNS constraints. Simultaneously, `public key:pkix verify hostname/3` falls back to the subject CommonName when no SAN is present, matching it against the reference hostname. This combination allows a subordinate CA with restricted DNS nameConstraints to issue a leaf certificate that an OTP TLS client accepts for an out-of-scope hostname. This bypass is reachable via `ssl:connect` using `verify peer`, a trusted CA, SNI, and the strict https hostname matcher.

Improper following of a certificate's chain of trust in the `pubkey cert` module allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. The function `pubkey cert:validate extensions/7` contains flaws where a certificate with `basicConstraints` set to `cA:false` and no `keyUsage` extension can be used as an intermediate issuer in a chain passed to `public key:pkix path validation/3`. This occurs because the `cA:false` clause does not reject the certificate when it is in the issuer position, and the `keyUsage` check is bypassed if the extension is entirely absent. Consequently, an attacker with an end-entity certificate issued by a trusted CA can sign forged leaf certificates for arbitrary identities. This affects all TLS or mTLS endpoints built on the OTP ssl application using the default verifier, including client-side server identity verification and mTLS server client certificate verification.

Improper Certificate Validation in the `pubkey ocsp` module of Erlang OTP `public key` allows forged Online Certificate Status Protocol (OCSP) responses signed with an expired responder certificate to be accepted as valid. The functions `verify response/5` and `is authorized responder/3` fail to check the validity period (`notBefore`/`notAfter`) of the OCSP responder certificate. An attacker possessing the private key of an expired CA-designated OCSP responder certificate can forge responses that the system accepts. This impacts TLS clients using OCSP stapling via the `ssl` application, potentially allowing a compromised server to present a revoked TLS certificate as valid. It also affects applications directly calling the `pkix ocsp validate/5` function, which may lead to authentication bypass during server-side client certificate validation.

A path traversal issue in the Erlang OTP ssh `ssh sftpd` module allows an authenticated SFTP user to modify file attributes outside the configured chroot directory. The SFTP daemon stores the raw, user-supplied path in file handles instead of the chroot-resolved path. When `SSH FXP FSETSTAT` is issued on such a handle, file attributes like permissions, ownership, and timestamps are modified on the real filesystem path, bypassing the root directory boundary. This requires the server to be configured with the root option and for the target file to exist on the real filesystem at the same relative path. This flaw only allows the modification of file attributes; file contents cannot be read or altered. If the SSH daemon runs as root, an attacker can achieve privilege escalation by setting the setuid bit on binaries, changing ownership of sensitive files, or making system configurations world-writable. The issue is associated with the file `lib/ssh/src/ssh sftpd.erl` and the functions `ssh sftpd:do open/4` and `ssh sftpd:handle op/4`.

An issue exists in the public key (pubkey ocsp module) of Erlang OTP related to improper certificate validation. Specifically, the OCSP response validation process does not verify the cryptographic signature of CA-designated responder certificates, relying only on issuer name matching and the OCSPSigning extended key usage. This allows an attacker to forge OCSP responses, potentially marking revoked certificates as valid. This impacts SSL/TLS clients using OCSP stapling and applications directly using the `public key:pkix ocsp validate/5` API. The vulnerable code is located in the files lib/public key/src/pubkey ocsp.erl and program routines `pubkey ocsp:is authorized responder/3`.

An issue exists in Erlang OTP ssh (ssh transport modules) that allows for Denial of Service via Resource Depletion. The SSH transport layer, by default, advertises legacy zlib compression and inflates attacker-controlled payloads without a size limit before authentication. This enables a reliable memory exhaustion attack. Two compression algorithms are affected: zlib, which activates immediately after key exchange, and zlib@openssh.com, which activates post-authentication. Each SSH packet can decompress approximately 255 MB from 256 KB of data, resulting in a 1029:1 amplification ratio. Multiple packets can quickly exhaust available memory, potentially causing Out-Of-Memory (OOM) kills in environments with limited memory. The issue is associated with the `ssh transport.erl` file and the `ssh transport:decompress/2` and `ssh transport:handle packet part/4` routines.

An improper limitation of a pathname to a restricted directory, specifically a 'Path Traversal' issue, exists in the Erlang OTP `ssh sftpd` module. The SFTP server uses string prefix matching with the `lists:prefix/2` function instead of proper path component validation when verifying if a path is within the configured root directory. This allows authenticated users to access sibling directories that share a common name prefix with the configured root directory. For example, if the root directory is set to `/home/user1`, paths like `/home/user10` or `/home/user1 backup` could be incorrectly considered within the root. The issue is associated with the program file `lib/ssh/src/ssh sftpd.erl` and the `ssh sftpd:is within root/2` function.

The software contains a Relative Path Traversal and Improper Isolation or Compartmentalization issue. The issue is associated with program files `lib/tftp/src/tftp file.erl` and `src/tftp file.erl`. The vulnerability affects the `tftp file` modules within erlang/otp, inets, and tftp.

An Allocation of Resources Without Limits or Throttling issue exists in Erlang OTP ssh (ssh sftp modules), potentially leading to Excessive Allocation and Resource Leak Exposure. The issue is associated with the `ssh sftpd.erl` file.