Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 3.8.0.
oryginał ENCVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HErlang Rebar3
APPErlang3.7.0 – 3.7.5
🔵
ZWERYFIKUJ U PRODUCENTA
Brak jednoznacznych danych o patchu. Sprawdź referencje od producenta.
Tagi
RCE
Powiązane podatności
CVE-2020-13802CRITICAL9.8PL ✓ten sam produkt
Rebar3 – command injection przez parametr URL zależności
CVE-2026-21619LOW2.0ten sam produkt
Podatność Uncontrolled Resource Consumption oraz Deserialization of Untrusted Data w modułach hex_api bibliote...
CVE-2025-32433CRITICAL10.0⚠ KEVPL ✓ten sam vendor
Erlang/OTP SSH — nieuwierzytelniony RCE (CVSS 10.0)
CVE-2026-55953CRITICAL9.1ten sam vendor
The Erlang/OTP ssl TLS 1.2 (and earlier) and DTLS client does not verify that the cipher suite selected by the...
CVE-2022-37026CRITICAL9.8PL ✓ten sam vendor
Erlang/OTP – obejście uwierzytelniania klienta w SSL/TLS/DTLS