[Buildroot] [PATCH] package/erlang: security bump to v26.2.5.21

[Buildroot] [PATCH] package/erlang: security bump to v26.2.5.21

[Thomas Perale via buildroot]

See the changelogs:

- https://www.erlang.org/patches/OTP-26.2.5.16
- https://www.erlang.org/patches/OTP-26.2.5.17
- https://www.erlang.org/patches/OTP-26.2.5.18
- https://www.erlang.org/patches/OTP-26.2.5.19
- https://www.erlang.org/patches/OTP-26.2.5.20
- https://www.erlang.org/patches/OTP-26.2.5.21

This fixes the following vulnerabilies:

- CVE-2026-21620:
    Relative Path Traversal, Improper Isolation or Compartmentalization
    vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp
    inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows
    Relative Path Traversal. This vulnerability is associated with program
    files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-21620

- CVE-2026-23941:
    Inconsistent Interpretation of HTTP Requests ('HTTP Request
    Smuggling') vulnerability in Erlang OTP (inets httpd module) allows
    HTTP Request Smuggling.  This vulnerability is associated with program
    files lib/inets/src/http_server/httpd_request.erl and program routines
    httpd_request:parse_headers/7.  The server does not reject or
    normalize duplicate Content-Length headers. The earliest Content-
    Length in the request is used for body parsing while common reverse
    proxies (nginx, Apache httpd, Envoy) honor the last Content-Length
    value. This violates RFC 9112 Section 6.3 and allows front-end/back-
    end desynchronization, leaving attacker-controlled bytes queued as the
    start of the next request.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-23941

- CVE-2026-23942:
    Improper Limitation of a Pathname to a Restricted Directory ('Path
    Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path
    Traversal.  This vulnerability is associated with program files
    lib/ssh/src/ssh_sftpd.erl and program routines
    ssh_sftpd:is_within_root/2.  The SFTP server uses string prefix
    matching via lists:prefix/2 rather than proper path component
    validation when checking if a path is within the configured root
    directory. This allows authenticated users to access sibling
    directories that share a common name prefix with the configured root
    directory. For example, if root is set to /home/user1, paths like
    /home/user10 or /home/user1_backup would incorrectly be considered
    within the root.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-23942

- CVE-2026-23943:
    Improper Handling of Highly Compressed Data (Compression Bomb)
    vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial
    of Service via Resource Depletion.  The SSH transport layer advertises
    legacy zlib compression by default and inflates attacker-controlled
    payloads pre-authentication without any size limit, enabling reliable
    memory exhaustion DoS.  Two compression algorithms are affected:  *
    zlib: Activates immediately after key exchange, enabling
    unauthenticated attacks * zlib@openssh.com: Activates post-
    authentication, enabling authenticated attacks  Each SSH packet can
    decompress ~255 MB from 256 KB of wire data (1029:1 amplification
    ratio). Multiple packets can rapidly exhaust available memory, causing
    OOM kills in memory-constrained environments.  This vulnerability is
    associated with program files lib/ssh/src/ssh_transport.erl and
    program routines ssh_transport:decompress/2,
    ssh_transport:handle_packet_part/4.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-23943

- CVE-2026-28810:
    Generation of Predictable Numbers or Identifiers vulnerability in
    Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache
    Poisoning.  The built-in DNS resolver (inet_res) uses a sequential,
    process-global 16-bit transaction ID for UDP queries and does not
    implement source port randomization. Response validation relies almost
    entirely on this ID, making DNS cache poisoning practical for an
    attacker who can observe one query or predict the next ID. This
    conflicts with RFC 5452 recommendations for mitigating forged DNS
    answers.  inet_res is intended for use in trusted network environments
    and with trusted recursive resolvers. Earlier documentation did not
    clearly state this deployment assumption, which could lead users to
    deploy the resolver in environments where spoofed DNS responses are
    possible.  This vulnerability is associated with program files
    lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-28810

- CVE-2026-32147:
    Improper Limitation of a Pathname to a Restricted Directory ('Path
    Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows
    an authenticated SFTP user to modify file attributes outside the
    configured chroot directory.  The SFTP daemon (ssh_sftpd) stores the
    raw, user-supplied path in file handles instead of the chroot-resolved
    path. When SSH_FXP_FSETSTAT is issued on such a handle, file
    attributes (permissions, ownership, timestamps) are modified on the
    real filesystem path, bypassing the root directory boundary entirely.
    Any authenticated SFTP user on a server configured with the root
    option can modify file attributes of files outside the intended chroot
    boundary. The prerequisite is that a target file must exist on the
    real filesystem at the same relative path. Note that this
    vulnerability only allows modification of file attributes; file
    contents cannot be read or altered through this attack vector.  If the
    SSH daemon runs as root, this enables direct privilege escalation: an
    attacker can set the setuid bit on any binary, change ownership of
    sensitive files, or make system configuration world-writable.  This
    vulnerability is associated with program files
    lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:do_open/4 and
    ssh_sftpd:handle_op/4.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-32147

- CVE-2026-42789:
    Improper Following of a Certificate's Chain of Trust vulnerability in
    Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate
    to be accepted as an intermediate issuer, enabling certificate chain
    forgery.  In lib/public_key/src/pubkey_cert.erl,
    pubkey_cert:validate_extensions/7 contains two flaws that together
    allow a certificate with basicConstraints cA:false and no keyUsage
    extension to be used as an intermediate issuer in a chain passed to
    public_key:pkix_path_validation/3: the cA:false clause recurses into
    the remaining extensions without rejecting the certificate when it is
    in issuer position, and the keyUsage check only fires when the
    extension is present, so a certificate lacking keyUsage entirely
    bypasses the keyCertSign enforcement.  Any party holding an end-entity
    certificate with basicConstraints cA:false and no keyUsage extension,
    issued by any CA in the victim's trust store, can use that
    certificate's private key to sign forged leaf certificates for
    arbitrary identities. public_key:pkix_path_validation/3 accepts the
    resulting chain, and by extension every TLS or mTLS endpoint built on
    the OTP ssl application that relies on the default verifier is
    affected, including server identity verification on the client side
    and client certificate verification on mTLS servers.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-42789

- CVE-2026-42790:
    Improper Certificate Validation vulnerability in Erlang OTP public_key
    (pubkey_cert and public_key modules) allows a DNS nameConstraints
    bypass via subject CommonName fallback in TLS hostname verification.
    Two flaws combine to allow a subordinate CA whose DNS nameConstraints
    are restricted (e.g. permitted;DNS:allowed.example.com) to issue a
    leaf certificate that an OTP TLS client accepts as a valid identity
    for an out-of-scope hostname (e.g. victim.example.com):  First,
    pubkey_cert:validate_names/6 in lib/public_key/src/pubkey_cert.erl
    only checks SAN DNS entries against nameConstraints. Per RFC 5280, a
    permitted DNS subtree only restricts certificates that contain a DNS-
    typed name. A leaf with no subjectAltName therefore trivially
    satisfies any permitted;DNS:... constraint regardless of its subject
    commonName.  Second, public_key:pkix_verify_hostname/3 in
    lib/public_key/src/public_key.erl falls back to the subject commonName
    when no subjectAltName is present, extracting id-at-commonName
    attributes as presented IDs and matching them against the reference
    hostname. The strict pkix_verify_hostname_match_fun(https) matcher
    does not suppress this fallback.  The result is that path validation
    accepts a CN-only leaf under a DNS-constrained intermediate (no SAN
    means the nameConstraints are not triggered), and hostname
    verification then accepts it via the CN fallback. The bypass is
    reachable from stock ssl:connect with verify_peer, a trusted CA, SNI,
    and the canonical strict https hostname matcher.

For more information, see:
 - https://www.cve.org/CVERecord?id=CVE-2026-42790

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
---
 package/erlang/erlang.hash | 4 ++--
 package/erlang/erlang.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/erlang/erlang.hash b/package/erlang/erlang.hash
index 7ff587e35c..667b27753e 100644
--- a/package/erlang/erlang.hash
+++ b/package/erlang/erlang.hash
@@ -1,5 +1,5 @@
-# From https://github.com/erlang/otp/releases/download/OTP-26.2.5.15/SHA256.txt
-sha256  28e6d63d82927f132d56289dd3c428ef8bce6bf2283c8549aa0a7afca1a8fe3b  otp_src_26.2.5.15.tar.gz
+# From https://github.com/erlang/otp/releases/download/OTP-26.2.5.21/SHA256.txt
+sha256  e1fde86f4e2874d4c136221a34753b5b785d762b910fb3fb35a23a6a7faf0a64  otp_src_26.2.5.21.tar.gz
 
 # Hash for license file
 sha256  809fa1ed21450f59827d1e9aec720bbc4b687434fa22283c6cb5dd82a47ab9c0  LICENSE.txt
diff --git a/package/erlang/erlang.mk b/package/erlang/erlang.mk
index 59353742f0..e038c66e0a 100644
--- a/package/erlang/erlang.mk
+++ b/package/erlang/erlang.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-ERLANG_VERSION = 26.2.5.15
+ERLANG_VERSION = 26.2.5.21
 ERLANG_RELEASE = $(firstword $(subst ., ,$(ERLANG_VERSION)))
 ERLANG_SITE = \
 	https://github.com/erlang/otp/releases/download/OTP-$(ERLANG_VERSION)
-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH] package/erlang: security bump to v26.2.5.21

[Peter Korsgaard]

>>>>> "Thomas" == Thomas Perale via buildroot <buildroot@buildroot.org> writes:

 > See the changelogs:
 > - https://www.erlang.org/patches/OTP-26.2.5.16
 > - https://www.erlang.org/patches/OTP-26.2.5.17
 > - https://www.erlang.org/patches/OTP-26.2.5.18
 > - https://www.erlang.org/patches/OTP-26.2.5.19
 > - https://www.erlang.org/patches/OTP-26.2.5.20
 > - https://www.erlang.org/patches/OTP-26.2.5.21

 > This fixes the following vulnerabilies:

s/vulnerabilies/vulnerabilities/

Committed with that fixed, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot