erlang-hex vulnerabilities (Ubuntu)
9 vulnerabilities.
-
erlang-hexUbuntu erl_tar:extract/2 loops forever on a GNU sparse member with a trailing hole 5.9 Medium -
erlang-hexUbuntu hex_core decompresses registry and Erlang term API responses without size limits 2.1 Low -
erlang-hexUbuntu Terminal escape sequence injection in Hex via unneutralized server-supplied output 2.3 Low -
erlang-hexUbuntu Path traversal in Hex via unvalidated dependency app names 7.5 High -
erlang-hexUbuntu Hex release-age cooldown is lifted package-wide when the locked release is retired 7.1 High -
erlang-hexUbuntu Hex writes unverified package tarballs to standard output in mix hex.package fetch 6.9 Medium -
erlang-hexUbuntu Hex trusts its bundled CA certificates when cacerts_path is set 5.9 Medium -
erlang-hexUbuntu hex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25 5.9 Medium -
erlang-hexUbuntu Lockfile checksums not verified in Hex allows dependency integrity bypass 8.9 High