Erlang OTP ssh vulnerabilities

An infinite loop vulnerability in the ssh_sftpd module of Erlang/OTP SSH allows an authenticated SFTP user to permanently block an SFTP channel. By sending extended data (SSH_MSG_CHANNEL_EXTENDED_DATA) with a non-zero type code, the attacker causes the handle_data/4 function to loop indefinitely, preventing further message processing on that channel.

A vulnerability in the ssh_sftpd module of the SSH server in OTP (Erlang) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The issue stems from improper path handling in the SSH_FXP_REALPATH handler, which does not canonicalize the path before checking restrictions.

Erlang/OTP ssh (ssh_auth, ssh_options modules) has an observable timing discrepancy vulnerability. With user_passwords or password option enabled, password checking for valid usernames takes ~300ms, while for invalid ones ~0ms, allowing unauthenticated remote username enumeration.

A Path Traversal vulnerability in the ssh_sftpd module of Erlang OTP ssh allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.