USN-7443-1: Erlang vulnerability

USN-7443-1: Erlang vulnerability
17 April 2025

Erlang could be made to run programs if it received specially crafted network traffic.

Releases

• Ubuntu 24.10
• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages
erlang - Concurrent, real-time, distributed functional language

Details
Fabian Bäumer, Marcel Maehren, Marcus Brinkmann, and Jörg Schwenk
discovered that Erlang OTP’s SSH module incorrect handled authentication. A
remote attacker could use this issue to execute arbitrary commands without
authentication, possibly leading to a system compromise.

Update instructions
The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.10

• erlang - 1:25.3.2.12+dfsg-1ubuntu2.3
• erlang-ssh - 1:25.3.2.12+dfsg-1ubuntu2.3
  Ubuntu 24.04
• erlang - 1:25.3.2.8+dfsg-1ubuntu4.3
• erlang-ssh - 1:25.3.2.8+dfsg-1ubuntu4.3
  Ubuntu 22.04
• erlang - 1:24.2.1+dfsg-1ubuntu0.4
• erlang-ssh - 1:24.2.1+dfsg-1ubuntu0.4
  Ubuntu 20.04
• erlang - 1:22.2.7+dfsg-1ubuntu0.5
• erlang-ssh - 1:22.2.7+dfsg-1ubuntu0.5
  After a standard system update you need to reboot your computer to make all the necessary changes.