erlang-hex vulnerabilities (Debian)
11 vulnerabilities.
-
erlang-hexDebian erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole 5.9 Medium -
erlang-hexDebian hex_core decompresses registry and Erlang term API responses without size limits 2.1 Low -
erlang-hexDebian Terminal escape sequence injection in Hex via unneutralized server-supplied output 2.3 Low -
erlang-hexDebian Path traversal in Hex via unvalidated dependency app names 7.5 High -
erlang-hexDebian Hex release-age cooldown is lifted package-wide when the locked release is retired 7.1 High -
erlang-hexDebian Hex writes unverified package tarballs to standard output in mix hex.package fetch 6.9 Medium -
erlang-hexDebian Hex exhausts memory and disk on oversized or compressed responses from an untrusted mirror 2.1 Low -
erlang-hexDebian Hex trusts its bundled CA certificates when cacerts_path is set 5.9 Medium -
erlang-hexDebian hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25 5.9 Medium -
erlang-hexDebian Lockfile checksums not verified in Hex allows dependency integrity bypass 8.9 High -
erlang-hexDebian Unsafe Deserialization of Erlang Terms in hex_core 2.0 Low