diff --git a/make/openvex.table b/make/openvex.table index d9a36f69bf24..c32ddd8c86ea 100644 --- a/make/openvex.table +++ b/make/openvex.table @@ -1,5 +1,14 @@ { "otp-26": [ + { + "pkg:otp/ssh@5.0": "CVE-2023-48795", + "status": { + "affected": "Update to any of the following versions: pkg:otp/ssh@5.1.1", + "fixed": [ + "pkg:otp/ssh@5.1.1" + ] + } + }, { "pkg:otp/ssh@5.0": "CVE-2025-48041", "status": { @@ -164,15 +173,6 @@ "not_affected": "vulnerable_code_not_present" } }, - { - "pkg:otp/ssh@5.1": "CVE-2023-48795", - "status": { - "affected": "Mitigation: If strict KEX availability cannot be ensured on both connection sides, affected encryption modes(CHACHA and CBC) can be disabled with standard ssh configuration. This will provide protection against vulnerability, but at a cost of affecting interoperability", - "fixed": [ - "pkg:otp/ssh@5.1.1" - ] - } - }, { "pkg:otp/ssh@5.0": "CVE-2025-26618", "status": { @@ -560,21 +560,15 @@ }, { "pkg:github/openssl/openssl@636dfadc70ce26f2473870570bfd9ec352806b1d": "CVE-2025-9230", - "status": { - "not_affected": "vulnerable_code_not_present" - } + "status": { "not_affected": "vulnerable_code_not_present" } }, { "pkg:github/openssl/openssl@636dfadc70ce26f2473870570bfd9ec352806b1d": "CVE-2025-9231", - "status": { - "not_affected": "vulnerable_code_not_present" - } + "status": { "not_affected": "vulnerable_code_not_present" } }, { "pkg:github/openssl/openssl@636dfadc70ce26f2473870570bfd9ec352806b1d": "CVE-2025-9232", - "status": { - "not_affected": "vulnerable_code_not_present" - } + "status": { "not_affected": "vulnerable_code_not_present" } } ], "otp-29": [ @@ -584,33 +578,23 @@ }, { "pkg:github/openssl/openssl@01d5e2318405362b4de5e670c90d9b40a351d053": "CVE-2025-4575", - "status": { - "not_affected": "vulnerable_code_not_present" - } + "status": { "not_affected": "vulnerable_code_not_present" } }, { "pkg:github/openssl/openssl@636dfadc70ce26f2473870570bfd9ec352806b1d": "CVE-2016-2183", - "status": { - "not_affected": "vulnerable_code_not_present" - } + "status": { "not_affected": "vulnerable_code_not_present" } }, { "pkg:github/openssl/openssl@636dfadc70ce26f2473870570bfd9ec352806b1d": "CVE-2025-9230", - "status": { - "not_affected": "vulnerable_code_not_present" - } + "status": { "not_affected": "vulnerable_code_not_present" } }, { "pkg:github/openssl/openssl@636dfadc70ce26f2473870570bfd9ec352806b1d": "CVE-2025-9231", - "status": { - "not_affected": "vulnerable_code_not_present" - } + "status": { "not_affected": "vulnerable_code_not_present" } }, { "pkg:github/openssl/openssl@636dfadc70ce26f2473870570bfd9ec352806b1d": "CVE-2025-9232", - "status": { - "not_affected": "vulnerable_code_not_present" - } + "status": { "not_affected": "vulnerable_code_not_present" } } ] } diff --git a/vex/otp-26.openvex.json b/vex/otp-26.openvex.json index fcd62affa14e..bec5fc9e7fac 100644 --- a/vex/otp-26.openvex.json +++ b/vex/otp-26.openvex.json @@ -3,8 +3,8 @@ "@id": "https://openvex.dev/docs/public/otp/vex-otp-26", "author": "vexctl", "timestamp": "2025-08-28T16:31:28.818462+02:00", - "last_updated": "2025-09-16T08:22:17.722696009Z", - "version": 49, + "last_updated": "2025-11-24T14:33:09.002873769+01:00", + "version": 48, "statements": [ { "vulnerability": { @@ -2109,38 +2109,6 @@ "status": "not_affected", "justification": "vulnerable_code_not_present" }, - { - "vulnerability": { - "name": "CVE-2023-48795" - }, - "timestamp": "2025-08-28T16:31:55.433429189+02:00", - "products": [ - { - "@id": "pkg:github/erlang/otp@OTP-26.2" - }, - { - "@id": "pkg:otp/ssh@5.1" - } - ], - "status": "affected", - "action_statement": "Mitigation: If strict KEX availability cannot be ensured on both connection sides, affected encryption modes(CHACHA and CBC) can be disabled with standard ssh configuration. This will provide protection against vulnerability, but at a cost of affecting interoperability", - "action_statement_timestamp": "2025-08-28T16:31:55.433429189+02:00" - }, - { - "vulnerability": { - "name": "CVE-2023-48795" - }, - "timestamp": "2025-08-28T16:31:55.449852183+02:00", - "products": [ - { - "@id": "pkg:github/erlang/otp@OTP-26.2.1" - }, - { - "@id": "pkg:otp/ssh@5.1.1" - } - ], - "status": "fixed" - }, { "vulnerability": { "name": "CVE-2025-26618" @@ -3611,6 +3579,62 @@ } ], "status": "fixed" + }, + { + "vulnerability": { + "name": "CVE-2023-48795" + }, + "timestamp": "2025-11-24T14:33:08.98061651+01:00", + "products": [ + { + "@id": "pkg:github/erlang/otp@OTP-26.0" + }, + { + "@id": "pkg:github/erlang/otp@OTP-26.0.1" + }, + { + "@id": "pkg:github/erlang/otp@OTP-26.0.2" + }, + { + "@id": "pkg:github/erlang/otp@OTP-26.1" + }, + { + "@id": "pkg:github/erlang/otp@OTP-26.1.1" + }, + { + "@id": "pkg:github/erlang/otp@OTP-26.1.2" + }, + { + "@id": "pkg:github/erlang/otp@OTP-26.2" + }, + { + "@id": "pkg:otp/ssh@5.0" + }, + { + "@id": "pkg:otp/ssh@5.0.1" + }, + { + "@id": "pkg:otp/ssh@5.1" + } + ], + "status": "affected", + "action_statement": "Update to any of the following versions: pkg:otp/ssh@5.1.1", + "action_statement_timestamp": "2025-11-24T14:33:08.98061651+01:00" + }, + { + "vulnerability": { + "name": "CVE-2023-48795" + }, + "timestamp": "2025-11-24T14:33:09.00287447+01:00", + "products": [ + { + "@id": "pkg:github/erlang/otp@OTP-26.2.1" + }, + { + "@id": "pkg:otp/ssh@5.1.1" + } + ], + "status": "fixed" } ] }