Debian dsa-6464 : erlang - security update

critical Nessus Plugin ID 339216

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6464 advisory.

- ------------------------------------------------------------------------- Debian Security Advisory DSA-6464-1 [email protected] https://www.debian.org/security/ Aron Xu August 25, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : erlang CVE ID : CVE-2026-28808 CVE-2026-28810 CVE-2026-32144 CVE-2026-32147 CVE-2026-42789 CVE-2026-42790 CVE-2026-42791 CVE-2026-42792 CVE-2026-47078 CVE-2026-48855 CVE-2026-48856 CVE-2026-48858 CVE-2026-48860 CVE-2026-49759 CVE-2026-49760 CVE-2026-53422 CVE-2026-54886 CVE-2026-54887 CVE-2026-54890 CVE-2026-54891 CVE-2026-55737 CVE-2026-55950 CVE-2026-55952 CVE-2026-55953 CVE-2026-58227 CVE-2026-59250 CVE-2026-59251 Debian Bug : 1139727 1139823 1141414 1142985

Multiple vulnerabilities were discovered in Erlang/OTP, a concurrent, real-time, distributed functional language, which may result in denial of service, information disclosure, authentication and certificate validation bypass, or the execution of arbitrary code. These vulnerbilities affect a wide range of components: TLS and certificate validation (ssl, public_key), SSH (ssh), network clients and servers (inets, ftp, epmd, kernel), runtime and libraries (erts, erl_interface, stdlib, megaco).

Several of these fixes tighten checks that were previously too permissive, and can cause configurations that worked before to stop working. The most likely to be noticed are:

- TLS clients using verify_peer, which is the default, now reject certificates that carry no subjectAltName extension; the customize_hostname_check option does not restore the old behaviour.

- Erlang distribution over TLS with the kernel 'check_ip' option now enforces the check that was previously a no-op, so clusters whose nodes are not on the same subnet lose distribution connectivity until the option is unset.

- TLS clients that request OCSP stapling now fail the handshake when the server provides no stapled response.

- Clients using TLS 1.2 or earlier now abort the handshake if the server sends an ALPN extension that the client did not advertise.

- DNS queries made through inet_res now use randomised source ports

For the stable distribution (trixie), these problems have been fixed in version 1:27.3.4.1+dfsg-1+deb13u3.

We recommend that you upgrade your erlang packages.

For the detailed security status of erlang please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/erlang

Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/

Mailing list: [email protected]

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the erlang packages.

Plugin Details

Severity: Critical

ID: 339216

File Name: debian_DSA-6464.nasl

Version: 1.1

Type: Local

Agent: unix

Family: Debian Local Security Checks

Published: 8/25/2026

Updated: 8/25/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.3

Percentile: 96.63

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-28808

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.1

Threat Score: 6.9

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-55953

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:13.0, p-cpe:/a:debian:debian_linux:erlang-asn1, p-cpe:/a:debian:debian_linux:erlang-base, p-cpe:/a:debian:debian_linux:erlang-common-test, p-cpe:/a:debian:debian_linux:erlang-crypto, p-cpe:/a:debian:debian_linux:erlang-debugger, p-cpe:/a:debian:debian_linux:erlang-dev, p-cpe:/a:debian:debian_linux:erlang-dialyzer, p-cpe:/a:debian:debian_linux:erlang-diameter, p-cpe:/a:debian:debian_linux:erlang-doc, p-cpe:/a:debian:debian_linux:erlang-edoc, p-cpe:/a:debian:debian_linux:erlang-eldap, p-cpe:/a:debian:debian_linux:erlang-et, p-cpe:/a:debian:debian_linux:erlang-eunit, p-cpe:/a:debian:debian_linux:erlang-examples, p-cpe:/a:debian:debian_linux:erlang-ftp, p-cpe:/a:debian:debian_linux:erlang-inets, p-cpe:/a:debian:debian_linux:erlang-jinterface, p-cpe:/a:debian:debian_linux:erlang-megaco, p-cpe:/a:debian:debian_linux:erlang-mnesia, p-cpe:/a:debian:debian_linux:erlang-mode, p-cpe:/a:debian:debian_linux:erlang-nox, p-cpe:/a:debian:debian_linux:erlang-observer, p-cpe:/a:debian:debian_linux:erlang-odbc, p-cpe:/a:debian:debian_linux:erlang-os-mon, p-cpe:/a:debian:debian_linux:erlang-parsetools, p-cpe:/a:debian:debian_linux:erlang-public-key, p-cpe:/a:debian:debian_linux:erlang-reltool, p-cpe:/a:debian:debian_linux:erlang-runtime-tools, p-cpe:/a:debian:debian_linux:erlang-snmp, p-cpe:/a:debian:debian_linux:erlang-src, p-cpe:/a:debian:debian_linux:erlang-ssh, p-cpe:/a:debian:debian_linux:erlang-ssl, p-cpe:/a:debian:debian_linux:erlang-syntax-tools, p-cpe:/a:debian:debian_linux:erlang-tftp, p-cpe:/a:debian:debian_linux:erlang-tools, p-cpe:/a:debian:debian_linux:erlang-wx, p-cpe:/a:debian:debian_linux:erlang-x11, p-cpe:/a:debian:debian_linux:erlang-xmerl, p-cpe:/a:debian:debian_linux:erlang

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 8/25/2026

Vulnerability Publication Date: 4/7/2026

Reference Information

CVE: CVE-2026-28808, CVE-2026-28810, CVE-2026-32144, CVE-2026-32147, CVE-2026-42789, CVE-2026-42790, CVE-2026-42791, CVE-2026-42792, CVE-2026-47078, CVE-2026-48855, CVE-2026-48856, CVE-2026-48858, CVE-2026-48860, CVE-2026-49759, CVE-2026-49760, CVE-2026-53422, CVE-2026-54886, CVE-2026-54887, CVE-2026-54890, CVE-2026-54891, CVE-2026-55737, CVE-2026-55950, CVE-2026-55952, CVE-2026-55953, CVE-2026-58227, CVE-2026-59250, CVE-2026-59251

IAVA: 2026-A-0309-S, 2026-A-0522-S, 2026-A-0594, 2026-A-0655-S, 2026-A-0785

Detections

Analytics

Debian dsa-6464 : erlang - security update

critical Nessus Plugin ID 339216

Synopsis

Description

Solution

See Also

Plugin Details

Risk Information

VPR

CVSS v2

CVSS v3

CVSS v4

Vulnerability Information

Reference Information