←back to thread

Unauthenticated Remote Code Execution in Erlang/OTP SSH

(nvd.nist.gov)
198 points kimi | 3 comments | 17 Apr 25 13:29 UTC | HN request time: 0.225s | source
1. throwawaymaths ◴[17 Apr 25 16:05 UTC] No.43718779[source]▶
most Elixir deployments are probably unaffected (obviously, please please check to be sure), as SSH is turned off by default.

https://paraxial.io/blog/erlang-ssh

replies(2): >>43719778 #>>43720031 #
2. giraffe_lady ◴[17 Apr 25 17:22 UTC] No.43719778[source]▶
This is also true of erlang right? This module is part of the stdlib but if you haven't implemented access using it it's "turned off" in the same way any other libraries you aren't using are.
3. __jonas ◴[17 Apr 25 17:45 UTC] No.43720031[source]▶
I'm assuming the most likely affected Elixir projects would be those using Nerves with SSH enabled and exposed to the public internet, as nerves_ssh wraps the OTP SSH daemon.

Don't think that's a very common thing to do, even in my hobby projects I would only access a Nerves device through a VPN.