Erlang/OTP 25.1 is the first maintenance patch package for OTP 25, with mostly bug fixes as well as quite many small improvements.
Below are some highlights of the release:
- A vulnerability has been discovered and corrected. It
is registered as CVE-2022-37026 “Client Authentication
Bypass”. Corrections have been released on the
supported tracks with patches 18.104.22.168, 22.214.171.124, and
25.0.2. The vulnerability might also exist in older OTP
versions. We recommend that impacted users upgrade to
one of these versions or later on the respective
tracks. OTP 25.1 would be an even better choice.
Impacted are those who are running an
server using the
ssl application either directly or
indirectly via other applications. For example via
cowboy, etc. Note that the vulnerability
only affects servers that request client certification,
that is sets the option
For more details and downloads follow this link
The Erlang/OTP source can also be found at GitHub on the official Erlang repository,
After upgrading to this release,
rebar3 eunit is failing after the
exact_execution is not in the options list, in here otp/eunit_data.erl at c194380712236c301188f0b401352f14c608c145 · u3s/otp · GitHub
To be precise, the error is that options is an empty list! So all
proplists:X/2 will fail with a
function_clause error when executed.
Check the Erlang/OTP github repo, both open issues and pull requests. There are multiple reports about rebar3 eunit failing with OTP-25.1. In particular see eunit: Fix `$ rebar3 eunit` error on OTP 25.1 by sile · Pull Request #6322 · erlang/otp · GitHub . I would recommend people to stay on 25.0.4 until a patch release (likely 25.1.1 but who knows) fixes the issue.
Eunit fix is planned to be released with OTP25.1.1 this week.
25.1.1 will be delayed till Monday, sorry for inconvenience.
Currently we are using Erlang 25.1.2 Version for the purpose of RabbitMQ and we have a security Vulnerability identified as part of Erlang otp installation, which indicates Erlang 25.1.2 using Crypto.dll (5.2.1) which using a vulnerable Openssl 1.1.1q. Is this vulnerable valid and is crypto.dll using OpenSll.1.1.1q or some other latest version?
OTP-25.1.2 does not depend on a special version of OpenSSL that depends on your build. If the vulnerability is for OpenSSL protocol implementation it is not relevant for OTP only if the vulnerability is on the libcrypto functions will it also affect OTP.