Expected behavior violation in otp - CVE-2025-46712

Vulnerability identifier: #VU108847

CSH Severity: Low

CVSS v4: 2.3 [CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N]

CVE-ID: CVE-2025-46712

CWE-ID: CWE-440

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to OTP SSH fails to enforce strict kex handshake hardening measures by allowing optional messages to be exchanged. A remote attacker can perform a Man-in-the-Middle attack and inject these messages in a connection during the handshake.

otp
PowerVC
Ubuntu
openEuler
erlang (Ubuntu package)
erlang-jinterface
erlang
erlang-inets
erlang-ftp
erlang-examples
erlang-eunit
erlang-et
erlang-erts
erlang-erl_interface
erlang-erl_docgen
erlang-eldap
erlang-edoc
erlang-diameter
erlang-dialyzer
erlang-debugsource
erlang-debuginfo
erlang-debugger
erlang-crypto
erlang-compiler
erlang-common_test
erlang-asn1
erlang-sasl
erlang-xmerl
erlang-wx
erlang-tools
erlang-tftp
erlang-syntax_tools
erlang-stdlib
erlang-ssl
erlang-ssh
erlang-src
erlang-snmp
erlang-kernel
erlang-runtime_tools
erlang-reltool
erlang-public_key
erlang-parsetools
erlang-os_mon
erlang-odbc
erlang-observer
erlang-mnesia
erlang-megaco

Install updates from vendor's website.

otp - addressed in versions 25.3.2.21, 26.2.5.12, 27.3.4
erlang (Ubuntu package) - addressed in versions 1:24.2.1+dfsg-1ubuntu0.5, 1:25.3.2.8+dfsg-1ubuntu4.4, 1:27.3+dfsg-1ubuntu1.2
erlang-jinterface - update to 25.3.2.6-7
erlang - update to 25.3.2.6-7
erlang-inets - update to 25.3.2.6-7
erlang-ftp - update to 25.3.2.6-7
erlang-examples - update to 25.3.2.6-7
erlang-eunit - update to 25.3.2.6-7
erlang-et - update to 25.3.2.6-7
erlang-erts - update to 25.3.2.6-7
erlang-erl_interface - update to 25.3.2.6-7
erlang-erl_docgen - update to 25.3.2.6-7
erlang-eldap - update to 25.3.2.6-7
erlang-edoc - update to 25.3.2.6-7
erlang-diameter - update to 25.3.2.6-7
erlang-dialyzer - update to 25.3.2.6-7
erlang-debugsource - update to 25.3.2.6-7
erlang-debuginfo - update to 25.3.2.6-7
erlang-debugger - update to 25.3.2.6-7
erlang-crypto - update to 25.3.2.6-7
erlang-compiler - update to 25.3.2.6-7
erlang-common_test - update to 25.3.2.6-7
erlang-asn1 - update to 25.3.2.6-7
erlang-sasl - update to 25.3.2.6-7
erlang-xmerl - update to 25.3.2.6-7
erlang-wx - update to 25.3.2.6-7
erlang-tools - update to 25.3.2.6-7
erlang-tftp - update to 25.3.2.6-7
erlang-syntax_tools - update to 25.3.2.6-7
erlang-stdlib - update to 25.3.2.6-7
erlang-ssl - update to 25.3.2.6-7
erlang-ssh - update to 25.3.2.6-7
erlang-src - update to 25.3.2.6-7
erlang-snmp - update to 25.3.2.6-7
erlang-kernel - update to 25.3.2.6-7
erlang-runtime_tools - update to 25.3.2.6-7
erlang-reltool - update to 25.3.2.6-7
erlang-public_key - update to 25.3.2.6-7
erlang-parsetools - update to 25.3.2.6-7
erlang-os_mon - update to 25.3.2.6-7
erlang-odbc - update to 25.3.2.6-7
erlang-observer - update to 25.3.2.6-7
erlang-mnesia - update to 25.3.2.6-7
erlang-megaco - update to 25.3.2.6-7

• https://github.com/erlang/otp/releases/tag/OTP-25.3.2.21
• https://github.com/erlang/otp/releases/tag/OTP-26.2.5.12
• https://github.com/erlang/otp/releases/tag/OTP-27.3.4
• https://github.com/erlang/otp/security/advisories/GHSA-934x-xq38-hhqf

• MitM attack in Erlang OTP SSH
• openEuler 24.03 LTS SP1 update for erlang
• openEuler 24.03 LTS update for erlang
• Ubuntu update for erlang
• IBM PowerVC update for Erlang/OTP