[ubuntu/jammy-updates] erlang 1:24.2.1+dfsg-1ubuntu0.5 (Accepted)

[Ubuntu Archive Robot]

erlang (1:24.2.1+dfsg-1ubuntu0.5) jammy-security; urgency=medium

  * SECURITY UPDATE: insufficient strict KEX handshake hardening measures
    - debian/patches/CVE-2025-46712-pre1.patch: postpone
      ssh_connection_handler init in
      lib/ssh/src/ssh_connection_handler.erl.
    - debian/patches/CVE-2025-46712-pre2.patch: implement KEX strict in
      lib/ssh/src/ssh.hrl, lib/ssh/src/ssh_connection_handler.erl,
      lib/ssh/src/ssh_fsm_kexinit.erl, lib/ssh/src/ssh_transport.erl,
      lib/ssh/src/ssh_transport.hrl, lib/ssh/test/ssh_protocol_SUITE.erl,
      lib/ssh/test/ssh_test_lib.erl, lib/ssh/test/ssh_to_openssh_SUITE.erl,
      lib/ssh/test/ssh_trpt_test_lib.erl.
    - debian/patches/CVE-2025-46712-1.patch: add KEX strict implementation
      fixes in lib/ssh/src/ssh_connection_handler.erl,
      lib/ssh/src/ssh_fsm_kexinit.erl, lib/ssh/src/ssh_transport.erl,
      lib/ssh/test/ssh_protocol_SUITE.erl,
      lib/ssh/test/ssh_trpt_test_lib.erl.
    - CVE-2025-46712
  * SECURITY UPDATE: path traversal and other issues in zip
    - debian/patches/CVE-2025-4748.patch: properly sanitize filenames when
      (un)zipping in lib/stdlib/src/zip.erl, lib/stdlib/test/zip_SUITE.erl.
    - CVE-2025-4748

Date: 2025-07-10 17:53:12.658566+00:00
Changed-By: Marc Deslauriers <marc.deslauriers at canonical.com>
Signed-By: Ubuntu Archive Robot <ubuntu-archive-robot at lists.canonical.com>
https://launchpad.net/ubuntu/+source/erlang/1:24.2.1+dfsg-1ubuntu0.5
-------------- next part --------------
Sorry, changesfile not available.