We found a new vulnerability in TLS. It's a variant of the ALPACA attack that bypasses current countermeasures. Relativly low impact - but great insight! Check it out: opossum-attack.com
08.07.2025 12:26 — 👍 12 🔁 8 💬 1 📌 0@skrillor.bsky.social
PhD Student @ruhr-uni-bochum.de | 🐢 Terrapin Attack | Interested in anything related to SSH and protocol security in general | Mastodon: @Skrillor@infosec.exchange
We found a new vulnerability in TLS. It's a variant of the ALPACA attack that bypasses current countermeasures. Relativly low impact - but great insight! Check it out: opossum-attack.com
08.07.2025 12:26 — 👍 12 🔁 8 💬 1 📌 0Affected versions:
<= OTP-27.3.2
<= OTP-26.2.5.10
<= OTP-25.3.2.19.
Fixed versions are OTP-27.3.3, OTP-26.2.5.11, OTP-25.3.2.20.
Link to the security advisory over on GitHub: github.com/erlang/otp/s...
Mitigation:
To mitigate this issue, please update to the latest version of Erlang/OTP as soon as possible. As an immediate workaround, prevent access via appropriate firewall rules.
We (@lambdafu.bsky.social & me) found a critical security vulnerability in the #Erlang/OTP SSH daemon that allow attackers to execute arbitrary code via network access on devices running Erlang/OTP SSH servers.
This vulnerability is #CVE-2025-32433, patches out now. Estimated CVSSv3 10.