Lukas Backström

**Name of the Vulnerable Software and Affected Versions** Erlang/OTP versions 26.0 through 29.0.1 Erlang/OTP version 28.5.0.1 and earlier Erlang/OTP version 27.3.4.12 and earlier ssl versions 11.0 through 11.7.1 ssl version 11.6.0.1 and earlier ssl version 11.2.12.8 and earlier **Description** An issue in the `inet tls dist` module allows an unauthenticated bypass of the LAN allowlist for Erlang distribution over TLS. The `check ip()` function incorrectly calls `sockname()` instead of `peername()` to retrieve the peer's IP address. Since `sockname()` returns the local socket address, the subnet mask comparison always succeeds regardless of the actual remote address. Consequently, any holder of a CA-signed TLS certificate can bypass LAN restrictions and gain full distribution access to the node, including the ability to use `rpc:call()` and `code:load binary()` functions. **Recommendations** Update Erlang/OTP to version 29.0.2, 28.5.0.2, or 27.3.4.13. Update ssl to version 11.7.2, 11.6.0.2, or 11.2.12.9. Implement a custom `verify fun` SSL option that correctly checks the peer IP address using `peername()` on the socket.

**Name of the Vulnerable Software and Affected Versions** Erlang OTP versions 17.0 through 28.0.1 Erlang OTP version 27.3.4.1 Erlang OTP version 26.2.5.13 stdlib versions 2.0 through 7.0.1 stdlib version 6.2.2.1 stdlib version 5.2.3.4 **Description** The issue is related to a Path Traversal vulnerability in Erlang OTP, specifically in the stdlib modules. This vulnerability allows Absolute Path Traversal and File Manipulation. It is associated with the program files lib/stdlib/src/zip.erl and the routines `zip:unzip/1`, `zip:unzip/2`, `zip:extract/1`, and `zip:extract/2`, unless the memory option is used. **Recommendations** For Erlang OTP versions 17.0 through 28.0.1, consider disabling the `zip:unzip/1` and `zip:unzip/2` functions until a patch is available. For Erlang OTP version 27.3.4.1, restrict access to the `zip:extract/1` and `zip:extract/2` routines to minimize the risk of exploitation. For Erlang OTP version 26.2.5.13, avoid using the `zip` module until the issue is resolved. For stdlib versions 2.0 through 7.0.1, consider applying configuration changes to limit the impact of the vulnerability. For stdlib version 6.2.2.1, restrict access to the vulnerable `zip.erl` file to prevent exploitation. For stdlib version 5.2.3.4, consider disabling the `zip` module as a temporary workaround until a patch is available.