Debian DSA 6464-1: Erlang/OTP Security Update Covering CVE-2006-28808 to CVE-2006-59251

Vulnerability Overview Vulnerability Name: [SECURITY] [DSA 6464-1] erlang security update Release Date: August 25, 2006 Vulnerability Type: Multiple vulnerabilities, including Denial of Service (DoS), information disclosure, authentication and certificate verification bypass, and arbitrary code execution. Scope of Impact Affected Software: Erlang/OTP Specific Vulnerabilities: - CVE-2006-28808 through CVE-2006-59251 - Impacts TLS and certificate verification (ssl, public_key), network clients and servers (inet, ftp, epmd, kernel), and the runtime and libraries (erts, erl_interface, stdlib, megaco). - Several fixes tightened permissions that were previously too permissive, potentially causing configurations to change from working normally to failing. - Specific issues include: - TLS clients using will now reject certificates that lack a extension. - Erlang distribution via TLS with the kernel option now enforces checks that were not previously enforced. - TLS clients requesting OCSP stapling will abort the handshake if the server does not provide a stapled response. - Clients using TLS 1.2 or earlier versions will abort the handshake if the server sends an ALPN extension. - DNS queries via now use randomized source ports. Remediation Fixed Versions: - Stable release (Etch): Version Recommended Actions: - Upgrade the Erlang packages. - Refer to the Debian Security Tracker page for detailed security status: https://security-tracker.debian.org/tracker/erlang - For more information and FAQs, see: https://www.debian.org/security/ POC Code or Exploit Code No POC code or exploit code was included in this page.

Goal Reached Thanks to every supporter — we hit 100%!

Debian DSA 6464-1: Erlang/OTP Security Update Covering CVE-2006-28808 to CVE-2006-59251