LoginSign Up
← Back to all sparks
E

Erlang/OTP

DEVOPS
Velocity5.0

Concurrent programming language and runtime for distributed systems

www.erlang.org ↗

Three OTP branches move as one release train, and SSH and epmd carry the security load.

runtimesecuritysshtlsbackportsepmd
◆Current state
Erlang/OTP is patching three branches in lockstep — 29 as current, 28 and 27 as maintenance — with each fix set published as a trio within minutes of itself. The window is dominated by security work in the network-facing applications: OTP 29.0.4 carried six CVEs including an epmd denial-of-service mitigation, and the 4 August trio brought SSH into line with RFC 4253 by rejecting packets not aligned to the cipher block size, with a timing-safe packet-discard path for CBC ciphers. A regression in the previous patch that stopped epmd binding to localhost was fixed in the same trio.
◆Where it's heading
The maintenance pattern is unusually strict: 27, 28 and 29 receive the same trouble reports on the same day, so the effective support window is wide and sites on older majors are not being pushed forward by security pressure. Where the fixes land is consistent — ssh, ssl, crypto, public_key and erts account for nearly every changed application across these releases, which is the distribution epmd and the TLS/SSH stack impose on a distributed runtime. The CBC timing mitigation in particular is an old class of attack being closed properly rather than papered over.
◆Prediction
Expect the next patch trio to follow the same shape — a small set of trouble reports applied to all three branches simultaneously — with ssh and ssl the most likely applications to change. Nothing in these entries indicates feature work landing on the patch branches; that stays on the next major.

◆Recent moves

  1. 5d ago

    SSH now rejects misaligned packets with a timing-safe discard

    Brings the SSH client and server into line with RFC 4253 by rejecting packets not aligned to the cipher block size, and adds a timing-safe discard path so structural errors are indistinguishable from MAC failures on CBC ciphers. Also fixes the epmd localhost binding regression introduced by the previous patch.

    View source ↗
  2. 5d ago

    OTP 28 takes the same SSH alignment and epmd fixes

    The OTP 28 cut of the 4 August fix set — identical trouble reports to the 29 and 27 releases published minutes either side. Worth noting the ssh application here cannot be applied independently on an arbitrary OTP 28 install, since it now requires crypto-5.7 from OTP 28.1.

    View source ↗
  3. 5d ago

    OTP 27 receives the same erts and ssh patches

    The OTP 27 cut of the same fix set. The release notes here carry no description at all — only a list of changed and unchanged applications — but erts and ssh are the two that moved, matching the epmd and SSH alignment work described on the 28 and 29 branches.

    View source ↗
  4. 12d ago

    27 July patch touches crypto, ssl, ssh and public_key on OTP 28

    Another contentless notes entry, listing eight changed applications concentrated in the crypto and transport stack. Published alongside the 27.3.4.15 and 29.0.4 releases, the last of which documents the six CVEs this set corresponds to.

    View source ↗
  5. 12d ago

    OTP 27 mirrors the 27 July crypto and transport patch

    The OTP 27 sibling of 28.5.0.4, with the same eight applications changed and no descriptive text. Sites on the oldest maintained branch get the same security content on the same day, which is the notable fact rather than the contents.

    View source ↗
  6. 12d ago

    OTP 29.0.4 carries six CVEs and an epmd DoS mitigation

    The substantive security release of the window: twenty trouble reports across compiler, crypto, diameter, erts, ssh, ssl and stdlib, with six CVEs and an epmd denial-of-service mitigation flagged under potential incompatibilities. This is the release the two contentless 27 July siblings are backporting.

    View source ↗