openSUSE-SU-2026:20907-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20907-1.json
JSON Data
https://api.osv.dev/v1/vulns/openSUSE-SU-2026:20907-1
Upstream
CVE (5)
Related
CVE (5)
Published
2026-06-05T11:01:03Z
Modified
2026-06-09T18:24:31Z
Summary
Security update for erlang
Details

This update for erlang fixes the following issues

  • CVE-2025-4748: improper limitation of a pathname may lead to path traversal (bsc#1244642).
  • CVE-2026-32147: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP chroot (bsc#1262503).
  • CVE-2026-42789: public_key application accepts non-CA certificates as intermediate issuers and this enables chain forgery (bsc#1266449).
  • CVE-2026-42790: Name Constraints and Subject CommonName fallback in TLS hostname verification allows for certificate forgery by MITM attacker (bsc#1266466).
  • CVE-2026-42791: OCSP response verification in the public_key application does not check the validity period of the OCSP responder certificate and allows for OCSP response response forgery (bsc#1266448).
References

Affected packages

openSUSE:Leap 16.0 / erlang

Package

Name
erlang
Purl
pkg:rpm/opensuse/erlang&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
27.1.3-160000.5.1

Ecosystem specific 

{
    "binaries":  [
        {
            "erlang":  "27.1.3-160000.5.1",
            "erlang-debugger":  "27.1.3-160000.5.1",
            "erlang-debugger-src":  "27.1.3-160000.5.1",
            "erlang-dialyzer":  "27.1.3-160000.5.1",
            "erlang-dialyzer-src":  "27.1.3-160000.5.1",
            "erlang-diameter":  "27.1.3-160000.5.1",
            "erlang-diameter-src":  "27.1.3-160000.5.1",
            "erlang-doc":  "27.1.3-160000.5.1",
            "erlang-epmd":  "27.1.3-160000.5.1",
            "erlang-et":  "27.1.3-160000.5.1",
            "erlang-et-src":  "27.1.3-160000.5.1",
            "erlang-jinterface":  "27.1.3-160000.5.1",
            "erlang-jinterface-src":  "27.1.3-160000.5.1",
            "erlang-observer":  "27.1.3-160000.5.1",
            "erlang-observer-src":  "27.1.3-160000.5.1",
            "erlang-reltool":  "27.1.3-160000.5.1",
            "erlang-reltool-src":  "27.1.3-160000.5.1",
            "erlang-src":  "27.1.3-160000.5.1",
            "erlang-wx":  "27.1.3-160000.5.1",
            "erlang-wx-src":  "27.1.3-160000.5.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20907-1.json"