-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 05 Jul 2026 21:21:35 +0300 Source: erlang Architecture: source Version: 1:29.0.3+dfsg-1 Distribution: unstable Urgency: medium Maintainer: Debian Erlang Packagers <pkg-erlang-devel@lists.alioth.debian.org> Changed-By: Sergei Golovan <sgolovan@debian.org> Closes: 1141414 Changes: erlang (1:29.0.3+dfsg-1) unstable; urgency=medium . * New upstream release. - Fix CVE-2026-53422: Observable Response Discrepancy vulnerability in Erlang OTP ssh application (ssh_sftpd module). - Fix CVE-2026-54886: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP ssh application (ssh_sftpd module). - Fix CVE-2026-54887: Use of Default Cryptographic Key vulnerability in Erlang/OTP ssl application (DTLS server) - Fix CVE-2026-54891: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Erlang/OTP ssl application (tls_gen_connection module). - Fix CVE-2026-55950: Time-of-check Time-of-use (TOCTOU) race condition vulnerability in Erlang/OTP ssl application (dtls_packet_demux module). - Fix CVE-2026-55952: The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. Closes: #1141414. Checksums-Sha1: aca9508adfed1d874e327e367485d9d3192e4815 5002 erlang_29.0.3+dfsg-1.dsc 83586fd37e285886b97064d60dc8addf6a045f5d 49270776 erlang_29.0.3+dfsg.orig.tar.xz ac8e94fa1e94c45c6dd654eab8b8faaf47df6da4 62292 erlang_29.0.3+dfsg-1.debian.tar.xz 94b75a6ff59936c4fb2b54c123e34f961fb38100 32816 erlang_29.0.3+dfsg-1_amd64.buildinfo Checksums-Sha256: 5a6d1e0ae550591ad6a7e67898a9ff353e6e2aee8e29033f592fb45b78ec1016 5002 erlang_29.0.3+dfsg-1.dsc 4fe8354860c804dee0ead66358775e0633fec987c14bd2be06e3698fd7cf865f 49270776 erlang_29.0.3+dfsg.orig.tar.xz eefff1f28ec69209cad336b85e9add647937e5aedefb066481fe21f63eab61bb 62292 erlang_29.0.3+dfsg-1.debian.tar.xz 0f588b468b38492a90818cc49ec17e10e2a74f15b3ca4764ddae54ff19d40e0f 32816 erlang_29.0.3+dfsg-1_amd64.buildinfo Files: 4abaa2a981f5c7779e4b550b26730746 5002 interpreters optional erlang_29.0.3+dfsg-1.dsc 7ddcfce419392820a2d4d5cea152a3e1 49270776 interpreters optional erlang_29.0.3+dfsg.orig.tar.xz 0ab530846a796637eca437f6e189531b 62292 interpreters optional erlang_29.0.3+dfsg-1.debian.tar.xz 5f71e98d08d8f725bada1b348ceaa876 32816 interpreters optional erlang_29.0.3+dfsg-1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE/SYPsyDB+ShSnvc4Tyrk60tj54cFAmpKo+cACgkQTyrk60tj 54cf3RAAsuFWLdrHdFU/PrkeCk0p+TKzGWY2UOubog2rO7EUthAR6SBggLGtuSXl SsIiSj3P2CLPPUPa+KalZZKioIq41LTxn6i2Udg8Kg5KvJZy+NAPCi//Yc7d854P cq02Fjq0cEIBpLkQHa4txBidViO383/W9BE+VKl4PnLyv2CxtNyF+z4Fn7G1vlk5 Aefm/XjYdejww7BS7lxEKuml3lnz6QETVtfnQL0jx57up5r5+WWErVrrpIyfPEqw WCXT4zKezNPoYxzUibGR8K438C3e4WwjpVJV8NKZuOKplianR/GutsmOka2pchQd qXoTX2pM6pFfTdPN4VYB+jIMsV6Ejs5A80jhSbynTxJ5xwqMuvN9L/HnCC13e/Rw XmMZE99rTCN7DTA7y7QcLpkVAZW/IRl7XeJt+qpuqXazU6CVhtSWKmWlylm5ztJC P5qFvBcno86pCrhUnYRwrtEKkpuNqDOiNeJAO5twI3In+tfvGqDuI193vw7/qrEk 4dH43mFPN2hwd+Kb5frK21C6sL6tB2z+N9J8CInUFR6orE9a5ejXZefJ5OUIk8uI K7Ih/RegOVDhBfN9gVaFqUjUrN86lsZvXOcW3cGDRAbdMicChtRUL9bJLeBswTAF B2R9oi7M3hJJdH/fL6gfjR2iSlm/ma3xfTJ1Gxdl3BWA8DLrWbQ= =eDYt -----END PGP SIGNATURE-----
