{ "document" : { "aggregate_severity" : { "text" : "kritisch" }, "category" : "csaf_base", "csaf_version" : "2.0", "distribution" : { "tlp" : { "label" : "WHITE", "url" : "https://www.first.org/tlp/" } }, "lang" : "de-DE", "notes" : [ { "category" : "legal_disclaimer", "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen." }, { "category" : "description", "text" : "Erlang/OTP (Open Telecom Platform) ist eine Sammlung von Bibliotheken und Tools, die auf der Programmiersprache Erlang basieren und für den Aufbau skalierbarer, fehlertoleranter und verteilter Systeme entwickelt wurden.", "title" : "Produktbeschreibung" }, { "category" : "summary", "text" : "Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Erlang/OTP ausnutzen, um beliebigen Programmcode auszuführen.", "title" : "Angriff" }, { "category" : "general", "text" : "- CISCO Appliance\n- Linux\n- UNIX", "title" : "Betroffene Betriebssysteme" } ], "publisher" : { "category" : "other", "contact_details" : "csaf-provider@cert-bund.de", "name" : "Bundesamt für Sicherheit in der Informationstechnik", "namespace" : "https://www.bsi.bund.de" }, "references" : [ { "category" : "self", "summary" : "WID-SEC-W-2025-0838 - CSAF Version", "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0838.json" }, { "category" : "self", "summary" : "WID-SEC-2025-0838 - Portal Version", "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-0838" }, { "category" : "external", "summary" : "Erlan GitHub vom 2025-04-16", "url" : "https://github.com/erlang/otp/security/advisories/GHSA-37cp-fgq5-7wc2" }, { "category" : "external", "summary" : "OSS Security Mailing List vom 2025-04-16", "url" : "https://seclists.org/oss-sec/2025/q2/52" }, { "category" : "external", "summary" : "PoC CVE-2025-32433 vom 2025-04-21", "url" : "https://github.com/ProDefense/CVE-2025-32433" }, { "category" : "external", "summary" : "Debian Security Advisory DSA-5906 vom 2025-04-20", "url" : "https://lists.debian.org/debian-security-announce/2025/msg00068.html" }, { "category" : "external", "summary" : "Debian Security Advisory DLA-4132 vom 2025-04-21", "url" : "https://lists.debian.org/debian-lts-announce/2025/04/msg00028.html" }, { "category" : "external", "summary" : "Ubuntu Security Notice USN-7443-1 vom 2025-04-17", "url" : "https://ubuntu.com/security/notices/USN-7443-1" }, { "category" : "external", "summary" : "SUSE Security Update SUSE-SU-2025:1356-1 vom 2025-04-22", "url" : "https://lists.suse.com/pipermail/sle-security-updates/2025-April/020738.html" }, { "category" : "external", "summary" : "Cisco Security Advisory CISCO-SA-ERLANG-OTP-SSH-XYZZY vom 2025-04-22", "url" : "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy" }, { "category" : "external", "summary" : "SUSE Security Update SUSE-SU-2025:1357-1 vom 2025-04-22", "url" : "https://lists.suse.com/pipermail/sle-security-updates/2025-April/020737.html" }, { "category" : "external", "summary" : "Ubuntu Security Notice USN-7443-2 vom 2025-04-23", "url" : "https://ubuntu.com/security/notices/USN-7443-2" }, { "category" : "external", "summary" : "Cisco Security Advisory CISCO-SA-ERLANG-OTP-SSH-XYZZY vom 2025-04-30", "url" : "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-erlang-otp-ssh-xyZZy" }, { "category" : "external", "summary" : "Dell Security Advisory DSA-2025-234 vom 2025-07-01", "url" : "https://www.dell.com/support/kbdoc/000337969" }, { "category" : "external", "summary" : "Ubuntu Security Notice USN-7443-3 vom 2025-07-17", "url" : "https://ubuntu.com/security/notices/USN-7443-3" }, { "category" : "external", "summary" : "Dell Security Advisory DSA-2025-334 vom 2025-11-05", "url" : "https://www.dell.com/support/kbdoc/de-de/000387872/dsa-2025-334-security-update-for-dell-networker-vproxy-multiple-third-party-component-vulnerabilities" } ], "source_lang" : "en-US", "title" : "Erlang/OTP SSH: Schwachstelle ermöglicht Codeausführung", "tracking" : { "current_release_date" : "2025-11-04T23:00:00.000+00:00", "generator" : { "date" : "2025-11-05T08:53:34.569+00:00", "engine" : { "name" : "BSI-WID", "version" : "1.4.0" } }, "id" : "WID-SEC-W-2025-0838", "initial_release_date" : "2025-04-16T22:00:00.000+00:00", "revision_history" : [ { "date" : "2025-04-16T22:00:00.000+00:00", "number" : "1", "summary" : "Initiale Fassung" }, { "date" : "2025-04-21T22:00:00.000+00:00", "number" : "2", "summary" : "PoC aufgenommen" }, { "date" : "2025-04-22T22:00:00.000+00:00", "number" : "3", "summary" : "Neue Updates von SUSE und Cisco aufgenommen" }, { "date" : "2025-04-23T22:00:00.000+00:00", "number" : "4", "summary" : "Neue Updates von Ubuntu aufgenommen" }, { "date" : "2025-05-01T22:00:00.000+00:00", "number" : "5", "summary" : "Weitere Cisco Produkte betroffen" }, { "date" : "2025-06-30T22:00:00.000+00:00", "number" : "6", "summary" : "Neue Updates von Dell aufgenommen" }, { "date" : "2025-07-17T22:00:00.000+00:00", "number" : "7", "summary" : "Neue Updates von Ubuntu aufgenommen" }, { "date" : "2025-11-04T23:00:00.000+00:00", "number" : "8", "summary" : "Neue Updates von Dell aufgenommen" } ], "status" : "final", "version" : "8" } }, "product_tree" : { "branches" : [ { "branches" : [ { "category" : "product_name", "name" : "Cisco Network Services Orchestrator", "product" : { "name" : "Cisco Network Services Orchestrator", "product_id" : "T021358", "product_identification_helper" : { "cpe" : "cpe:/a:cisco:network_services_orchestrator:-" } } }, { "branches" : [ { "category" : "product_version", "name" : "ASR 5000", "product" : { "name" : "Cisco Router ASR 5000", "product_id" : "T007902", "product_identification_helper" : { "cpe" : "cpe:/h:cisco:router:asr_5000" } } } ], "category" : "product_name", "name" : "Router" }, { "branches" : [ { "category" : "product_version", "name" : "RV160", "product" : { "name" : "Cisco Small Business RV160", "product_id" : "T018236", "product_identification_helper" : { "cpe" : "cpe:/h:cisco:small_business:rv160" } } }, { "category" : "product_version", "name" : "RV340", "product" : { "name" : "Cisco Small Business RV340", "product_id" : "T020042", "product_identification_helper" : { "cpe" : "cpe:/h:cisco:small_business:rv340" } } }, { "category" : "product_version", "name" : "RV340W", "product" : { "name" : "Cisco Small Business RV340W", "product_id" : "T020043", "product_identification_helper" : { "cpe" : "cpe:/h:cisco:small_business:rv340w" } } }, { "category" : "product_version", "name" : "RV345P", "product" : { "name" : "Cisco Small Business RV345P", "product_id" : "T020044", "product_identification_helper" : { "cpe" : "cpe:/h:cisco:small_business:rv345p" } } }, { "category" : "product_version", "name" : "RV345", "product" : { "name" : "Cisco Small Business RV345", "product_id" : "T020045", "product_identification_helper" : { "cpe" : "cpe:/h:cisco:small_business:rv345" } } }, { "category" : "product_version", "name" : "RV260", "product" : { "name" : "Cisco Small Business RV260", "product_id" : "T024166", "product_identification_helper" : { "cpe" : "cpe:/h:cisco:small_business:rv260" } } }, { "category" : "product_version", "name" : "RV260W", "product" : { "name" : "Cisco Small Business RV260W", "product_id" : "T043250", "product_identification_helper" : { "cpe" : "cpe:/h:cisco:small_business:rv260w" } } }, { "category" : "product_version", "name" : "RV260P", "product" : { "name" : "Cisco Small Business RV260P", "product_id" : "T043251", "product_identification_helper" : { "cpe" : "cpe:/h:cisco:small_business:rv260p" } } }, { "category" : "product_version", "name" : "RV160W", "product" : { "name" : "Cisco Small Business RV160W", "product_id" : "T043252", "product_identification_helper" : { "cpe" : "cpe:/h:cisco:small_business:rv160w" } } } ], "category" : "product_name", "name" : "Small Business" } ], "category" : "vendor", "name" : "Cisco" }, { "branches" : [ { "category" : "product_name", "name" : "Debian Linux", "product" : { "name" : "Debian Linux", "product_id" : "2951", "product_identification_helper" : { "cpe" : "cpe:/o:debian:debian_linux:-" } } } ], "category" : "vendor", "name" : "Debian" }, { "branches" : [ { "branches" : [ { "category" : "product_version_range", "name" : "<19.13", "product" : { "name" : "Dell NetWorker <19.13", "product_id" : "T044954" } }, { "category" : "product_version", "name" : "19.13", "product" : { "name" : "Dell NetWorker 19.13", "product_id" : "T044954-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:dell:networker:19.13" } } }, { "category" : "product_version_range", "name" : "<19.11.0.5", "product" : { "name" : "Dell NetWorker <19.11.0.5", "product_id" : "T044959" } }, { "category" : "product_version", "name" : "19.11.0.5", "product" : { "name" : "Dell NetWorker 19.11.0.5", "product_id" : "T044959-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:dell:networker:19.11.0.5" } } }, { "category" : "product_version_range", "name" : "vProxy <19.12.0.3", "product" : { "name" : "Dell NetWorker vProxy <19.12.0.3", "product_id" : "T048302" } }, { "category" : "product_version", "name" : "vProxy 19.12.0.3", "product" : { "name" : "Dell NetWorker vProxy 19.12.0.3", "product_id" : "T048302-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:dell:networker:vproxy__19.12.0.3" } } } ], "category" : "product_name", "name" : "NetWorker" } ], "category" : "vendor", "name" : "Dell" }, { "branches" : [ { "branches" : [ { "category" : "product_version_range", "name" : "