Zhang Delong

**Name of the Vulnerable Software and Affected Versions** Erlang OTP versions 27.1 through 27.3.4.14 Erlang OTP versions 28.0 through 28.5.0.3 Erlang OTP versions 29.0 through 29.0.3 **Description** A relative path traversal issue in the stdlib zip module allows writing files outside the intended extraction directory when processing a crafted zip archive. The functions `zip:unzip/1,2` and `zip:extract/1,2` use `zip:check dir level/2` to validate entry paths by tracking directory depth with an integer counter. Because the validation only rejects paths where the final counter value is negative, a path like `../x/y` can cause the counter to go negative during traversal and then return to zero, bypassing the check and resolving to a location outside the extraction directory via `add cwd`. This issue is located in the `lib/stdlib/src/zip.erl` file. **Recommendations** Update Erlang OTP to version 27.3.4.15 or later. Update Erlang OTP to version 28.5.0.4 or later. Update Erlang OTP to version 29.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Erlang/OTP versions 29.0 through 29.0.1 ssh versions 6.0 through 6.0.0 **Description** A timing side-channel in password authentication allows unauthenticated remote attackers to enumerate usernames. When the SSH daemon is configured with the `user passwords` or `password` option, the `check password/3()` function in the `ssh auth` module performs a PBKDF2-SHA256 computation for valid usernames, taking approximately 300ms. Conversely, for invalid usernames, the `get password option/2()` function in the `ssh options` module returns immediately. This discrepancy allows an attacker to distinguish between valid and invalid usernames in a single attempt. **Recommendations** Update Erlang/OTP to version 29.0.2 or later. Update ssh to version 6.0.1 or later. Use the `pwdfun` option instead of `user passwords` for password authentication. Restrict SSH port access to trusted networks via firewall rules.

**Name of the Vulnerable Software and Affected Versions** Erlang OTP versions 17.0 through 27.3.4.12 Erlang OTP version 28.5.0.1 Erlang OTP version 29.0.1 erts versions 6.0 through 15.2.7.8 erts version 16.4.0.1 erts version 17.0.1 **Description** A stack-based buffer overflow exists in the `sctp parse error chunk()` function within `erts/emulator/drivers/common/inet drv.c`. The function parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated `spec[]` array without performing bounds checking. An unauthenticated remote attacker with an established SCTP association to a listening port can send a crafted SCTP ERROR chunk containing excessive cause codes to overflow the stack buffer, resulting in a crash of the BEAM VM (Denial of Service). Because the attacker can only write 16-bit values interleaved with a fixed tag, a controlled return address cannot be achieved. Additionally, a crafted SCTP ERROR chunk may leak fragments of Erlang VM memory into the received error packet, though the disclosure scope is limited as the data is already readable by the user running the VM. This issue requires SCTP support to be compiled into OTP and a listening SCTP socket to be opened via `gen sctp` with the default inet backend. **Recommendations** Update Erlang OTP to version 27.3.4.13, 28.5.0.2, or 29.0.2. Update erts to version 15.2.7.9, 16.4.0.2, or 17.0.2.