Erlang OTP ssh vulnerabilities

The ssh library in Erlang/OTP contains an Allocation of Resources Without Limits or Throttling vulnerability. An authenticated remote attacker can exhaust node memory by repeatedly opening session channels that are never assigned a handler. This affects OTP from 18.1.2 before 27.3.4.18, 28.5.0.7, and 29.1.1 (corresponding to ssh from 4.1.1 before 5.2.11.13, 5.5.2.6, and 6.0.6).

An infinite loop vulnerability in the ssh_sftpd module of Erlang/OTP SSH allows an authenticated SFTP user to permanently block an SFTP channel. By sending extended data (SSH_MSG_CHANNEL_EXTENDED_DATA) with a non-zero type code, the attacker causes the handle_data/4 function to loop indefinitely, preventing further message processing on that channel.

A vulnerability in the ssh_sftpd module of the SSH server in OTP (Erlang) allows an authenticated SFTP user to enumerate the existence of files and directories outside the configured root directory. The issue stems from improper path handling in the SSH_FXP_REALPATH handler, which does not canonicalize the path before checking restrictions.

Erlang/OTP ssh (ssh_auth, ssh_options modules) has an observable timing discrepancy vulnerability. With user_passwords or password option enabled, password checking for valid usernames takes ~300ms, while for invalid ones ~0ms, allowing unauthenticated remote username enumeration.

Erlang OTP ssh (ssh_sftpd module) has an information disclosure vulnerability. The SSH_FXP_READLINK handler sends the raw result of file:read_link/2 without stripping the backend root prefix, allowing an authenticated SFTP client to discover the absolute path of the SFTP directory. Affects OTP from 17.0 before 27.3.4.13, 28.5.0.2, and 29.0.2.

A Path Traversal vulnerability in the ssh_sftpd module of Erlang OTP ssh allows an authenticated SFTP user to modify file attributes outside the configured chroot directory.