SSH_FXP_OPENDIR may Lead to Exhaustion of File Handles

7.1

HIGH

Vulnerability description

Allocation of Resources Without Limits or Throttling vulnerability in Erlang OTP ssh (ssh_sftp modules) allows Excessive Allocation, Flooding.

This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl.

This issue affects OTP form OTP 17.0 until OTP 28.0.3, OTP 27.3.4.3 and 26.2.5.15 corresponding to ssh from 3.0.1 until 5.3.3, 5.2.11.3 and 5.1.4.12.

Module	Source File
`ssh_sftp`	`lib/ssh/src/ssh_sftpd.erl`

Status	Type	Version	Changes / Fixed in
affected	otp ^ⓘ	`3.0.1`	unaffected at `5.3.3` unaffected at `5.2.11.3` unaffected at `5.1.4.12`

Module	Source File
`ssh_sftp`	`lib/ssh/src/ssh_sftpd.erl`

Status	Type	Version	Changes / Fixed in
affected	otp ^ⓘ	`17.0`	unaffected at `28.0.3` unaffected at `27.3.4.3` unaffected at `26.2.5.15`
affected	git ^ⓘ	`07b8f441ca71`	unaffected at `5f9af63eec46` unaffected at `d49efa2d4fa9`

disabling SFTP
limiting number of max_sessions allowed for sshd, so exploiting becomes more complicated