Zhang Delong

**Name of the Vulnerable Software and Affected Versions** Erlang/OTP versions 29.0 through 29.0.1 ssh versions 6.0 through 6.0.0 **Description** A timing side-channel in password authentication allows unauthenticated remote attackers to enumerate usernames. When the SSH daemon is configured with the `user passwords` or `password` option, the `check password/3()` function in the `ssh auth` module performs a PBKDF2-SHA256 computation for valid usernames, taking approximately 300ms. Conversely, for invalid usernames, the `get password option/2()` function in the `ssh options` module returns immediately. This discrepancy allows an attacker to distinguish between valid and invalid usernames in a single attempt. **Recommendations** Update Erlang/OTP to version 29.0.2 or later. Update ssh to version 6.0.1 or later. Use the `pwdfun` option instead of `user passwords` for password authentication. Restrict SSH port access to trusted networks via firewall rules.

**Name of the Vulnerable Software and Affected Versions** Erlang OTP versions 17.0 through 27.3.4.12 Erlang OTP version 28.5.0.1 Erlang OTP version 29.0.1 erts versions 6.0 through 15.2.7.8 erts version 16.4.0.1 erts version 17.0.1 **Description** A stack-based buffer overflow exists in the `sctp parse error chunk()` function within `erts/emulator/drivers/common/inet drv.c`. The function parses SCTP ERROR chunks and writes cause codes into a fixed-size stack-allocated `spec[]` array without performing bounds checking. An unauthenticated remote attacker with an established SCTP association to a listening port can send a crafted SCTP ERROR chunk containing excessive cause codes to overflow the stack buffer, resulting in a crash of the BEAM VM (Denial of Service). Because the attacker can only write 16-bit values interleaved with a fixed tag, a controlled return address cannot be achieved. Additionally, a crafted SCTP ERROR chunk may leak fragments of Erlang VM memory into the received error packet, though the disclosure scope is limited as the data is already readable by the user running the VM. This issue requires SCTP support to be compiled into OTP and a listening SCTP socket to be opened via `gen sctp` with the default inet backend. **Recommendations** Update Erlang OTP to version 27.3.4.13, 28.5.0.2, or 29.0.2. Update erts to version 15.2.7.9, 16.4.0.2, or 17.0.2.