openSUSE-SU-2026:20907-1

See a problem?
Import Source
https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20907-1.json
JSON Data
https://api.test.osv.dev/v1/vulns/openSUSE-SU-2026:20907-1
Upstream
CVE (5)
Related
CVE (5)
Published
2026-06-05T11:01:03Z
Modified
2026-06-09T18:24:46Z
Summary
Security update for erlang
Details

This update for erlang fixes the following issues

  • CVE-2025-4748: improper limitation of a pathname may lead to path traversal (bsc#1244642).
  • CVE-2026-32147: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in SFTP chroot (bsc#1262503).
  • CVE-2026-42789: public_key application accepts non-CA certificates as intermediate issuers and this enables chain forgery (bsc#1266449).
  • CVE-2026-42790: Name Constraints and Subject CommonName fallback in TLS hostname verification allows for certificate forgery by MITM attacker (bsc#1266466).
  • CVE-2026-42791: OCSP response verification in the public_key application does not check the validity period of the OCSP responder certificate and allows for OCSP response response forgery (bsc#1266448).
References

Affected packages

openSUSE:Leap 16.0 / erlang

Package

Name
erlang
Purl
pkg:rpm/opensuse/erlang&distro=openSUSE%20Leap%2016.0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
27.1.3-160000.5.1

Ecosystem specific 

{
    "binaries": [
        {
            "erlang": "27.1.3-160000.5.1",
            "erlang-debugger": "27.1.3-160000.5.1",
            "erlang-debugger-src": "27.1.3-160000.5.1",
            "erlang-dialyzer": "27.1.3-160000.5.1",
            "erlang-dialyzer-src": "27.1.3-160000.5.1",
            "erlang-diameter": "27.1.3-160000.5.1",
            "erlang-diameter-src": "27.1.3-160000.5.1",
            "erlang-doc": "27.1.3-160000.5.1",
            "erlang-epmd": "27.1.3-160000.5.1",
            "erlang-et": "27.1.3-160000.5.1",
            "erlang-et-src": "27.1.3-160000.5.1",
            "erlang-jinterface": "27.1.3-160000.5.1",
            "erlang-jinterface-src": "27.1.3-160000.5.1",
            "erlang-observer": "27.1.3-160000.5.1",
            "erlang-observer-src": "27.1.3-160000.5.1",
            "erlang-reltool": "27.1.3-160000.5.1",
            "erlang-reltool-src": "27.1.3-160000.5.1",
            "erlang-src": "27.1.3-160000.5.1",
            "erlang-wx": "27.1.3-160000.5.1",
            "erlang-wx-src": "27.1.3-160000.5.1"
        }
    ]
}

Database specific

source 
"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20907-1.json"