CVE-2019-1000014

Name	CVE-2019-1000014
Description	Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirror. This vulnerability appears to have been fixed in 3.8.0.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium
Debian Bugs	824773

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rebar (PTS)	buster, stretch	2.6.4-2	fixed
	bullseye, sid	2.6.4-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
rebar	source	(unstable)	(not affected)
rebar3	ITP					824773

- rebar <not-affected> (vulnerable code is not present)
https://github.com/erlang/rebar3/pull/1986