←back to thread

Unauthenticated Remote Code Execution in Erlang/OTP SSH

(nvd.nist.gov)
198 points kimi | 1 comments | 17 Apr 25 13:29 UTC | HN request time: 0.206s | source
Show context
throwawaymaths ◴[17 Apr 25 16:05 UTC] No.43718779[source]▶
most Elixir deployments are probably unaffected (obviously, please please check to be sure), as SSH is turned off by default.

https://paraxial.io/blog/erlang-ssh

replies(2): >>43719778 #>>43720031 #
1. __jonas ◴[17 Apr 25 17:45 UTC] No.43720031[source]▶
I'm assuming the most likely affected Elixir projects would be those using Nerves with SSH enabled and exposed to the public internet, as nerves_ssh wraps the OTP SSH daemon.

Don't think that's a very common thing to do, even in my hobby projects I would only access a Nerves device through a VPN.