Skip to content

Commit ea0beba

Browse files
kikofernandezkikofernandez
committed
add openvex docs
1 parent 2a7c5d5 commit ea0beba

File tree

4 files changed

+145
-0
lines changed

4 files changed

+145
-0
lines changed

‎system/doc/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,3 +44,6 @@ to use Erlang/OTP and different aspects of working with Erlang/OTP. The guides a
4444
interoperability between Erlang and C.
4545
* [Embedded Systems User's Guide](embedded/embedded.md) -
4646
This section describes the issues that are specific for running Erlang on an embedded system.
47+
* [VEX Statements](vex/vulnerabilities.md) -
48+
This section describes how Erlang/OTP reports OpenVex statements and their meaning
49+
towards third parties.

‎system/doc/docs.exs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
"system_principles/versions.md": [],
3333
"system_principles/misc.md": [],
3434
"sbom/sbom.md": [],
35+
"vulnerabilities/vulnerabilities.md": [],
3536
"embedded/embedded.md": [],
3637
"getting_started/getting_started.md": [],
3738
"getting_started/seq_prog.md": [],

‎system/doc/guides‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,4 @@ efficiency_guide:Efficiency Guide
88
tutorial:Interoperability Tutorial
99
embedded:Embedded Systems User's Guide
1010
sbom:Software Bill Of Materials
11+
vulnerabilities:VEX Statements

‎system/doc/vulnerabilities/vulnerabilities.md‎

Lines changed: 140 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,140 @@
1+
<!--
2+
%CopyrightBegin%
3+
4+
SPDX-License-Identifier: Apache-2.0
5+
6+
Copyright Ericsson AB 2025. All Rights Reserved.
7+
8+
Licensed under the Apache License, Version 2.0 (the "License");
9+
you may not use this file except in compliance with the License.
10+
You may obtain a copy of the License at
11+
12+
http://www.apache.org/licenses/LICENSE-2.0
13+
14+
Unless required by applicable law or agreed to in writing, software
15+
distributed under the License is distributed on an "AS IS" BASIS,
16+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
17+
See the License for the specific language governing permissions and
18+
limitations under the License.
19+
20+
%CopyrightEnd%
21+
-->
22+
23+
# Vulnerabilities
24+
25+
[](){: #vulnerabilities }
26+
27+
## Introduction
28+
29+
This section describes how Erlang/OTP reports vulnerabilities for Erlang/OTP
30+
CVEs and third party dependencies on which Erlang/OTP builds upon.
31+
32+
Erlang/OTP reports all vulnerabilities using the [OpenVEX
33+
specification](https://github.com/openvex/spec). This specification allows to
34+
easily describe which CVEs affect which Erlang/OTP versions and specific OTP
35+
applications. It also records which CVEs from third parties affect (or do not
36+
affect) Erlang/OTP.
37+
38+
Erlang/OTP releases OpenVEX statements under `vex/otp-<version>.openvex.json` in
39+
the [Erlang/OTP Github repository](https://github.com/erlang/otp) in the `master` branch, where
40+
`<version>` corresponds to the number of the Erlang/OTP release.
41+
42+
## Erlang/OTP VEX Statements
43+
44+
Erlang/OTP OpenVEX statements specify which Erlang/OTP versions are affected/fixed (e.g.,
45+
`pkg:otp/[email protected]`), as well as the specific Erlang/OTP application number
46+
of all affected versions (e.g., `pkg:otp/[email protected]`).
47+
48+
As an example, a snippet of the `vex/otp-27.openvex.json` contains the
49+
vulnerability identified by `CVE-2025-32433`, following by the status of the
50+
vulnerability (`affected`), the affected Erlang/OTP releases, namely `27.3.1`
51+
and `27.3.2`, and the Erlang/OTP application that was vulnerable, `[email protected]`.
52+
The affected versions are reported using the release version and the
53+
application because it is possible to update the application independently
54+
from the release.
55+
In some cases, there may be an optional action statement that describes a workaround
56+
to avoid the mentioned vulnerability.
57+
58+
```
59+
{
60+
"vulnerability": {
61+
"name": "CVE-2025-32433"
62+
},
63+
"timestamp": "2025-06-18T12:18:16.661272703+02:00",
64+
"products": [
65+
{ "@id": "pkg:otp/[email protected]" },
66+
{ "@id": "pkg:otp/[email protected]" },
67+
{ "@id": "pkg:otp/[email protected]" }
68+
],
69+
"status": "affected",
70+
"action_statement": "A temporary workaround involves disabling the SSH server or to prevent access via firewall rules.",
71+
"action_statement_timestamp": "2025-06-18T12:18:16.661272703+02:00"
72+
},
73+
```
74+
75+
The fixed version will be reported in a similar fashion as follows, in the same document.
76+
As an example, there is a new statement for `CVE-2025-32433` with status `fixed`,
77+
that links to the versions that do not suffer from `CVE-2025-32433`, namely
78+
`[email protected]` and `otp/[email protected]`.
79+
80+
```
81+
{
82+
"vulnerability": {
83+
"name": "CVE-2025-32433"
84+
},
85+
"timestamp": "2025-06-18T12:18:16.676540081+02:00",
86+
"products": [
87+
{ "@id": "pkg:otp/[email protected]" },
88+
{ "@id": "pkg:otp/[email protected]" }
89+
],
90+
"status": "fixed"
91+
},
92+
```
93+
94+
## Third Party VEX Statements
95+
96+
Erlang/OTP generates statements for 3rd parties from which the project depends
97+
on. It is really important to understand the scope of the third party
98+
applications, since Erlang/OTP vendors some libraries as part of the runtime.
99+
100+
Vendoring means that Erlang/OTP code contains a local copy of a library.
101+
There are numerous use cases for why this is necessary, and we will not cover the use cases here.
102+
103+
**This excludes dynamically or statically linked libraries during the Erlang/OTP build process. For instance, any security related Erlang application will rely on dynamically or statically linked version of OpenSSL cryptolib.**
104+
105+
Erlang/OTP reports vulnerabilities for any source code that is vulnerable and
106+
included in the Erlang/OTP release.
107+
108+
The OpenVEX statements for our third party libraries specify the affected/fixed
109+
version using the commit SHA1 from their respective repository. This is simply
110+
because our third party dependencies are in C/C++ and vulnerability scanners
111+
such as OSV report vulnerabilities in ranges.
112+
113+
As an example, we mention that the OpenSSL code that Erlang/OTP vendors
114+
is not susceptible for `CVE-2023-6129`, as follows:
115+
116+
```
117+
{
118+
"vulnerability": {
119+
"name": "CVE-2023-6129"
120+
},
121+
"timestamp": "2025-06-18T12:18:16.47247833+02:00",
122+
"products": [
123+
{ "@id": "pkg:github/openssl/openssl@01d5e2318405362b4de5e670c90d9b40a351d053" }
124+
],
125+
"status": "not_affected",
126+
"justification": "vulnerable_code_not_present"
127+
}
128+
```
129+
130+
Diving into the example, this means that Erlang/OTP vendors a version of `openssl` taken from commit `01d5e2318405362b4de5e670c90d9b40a351d053` from the repository `https://github.com/openssl/openssl/commit/01d5e2318405362b4de5e670c90d9b40a351d053` (version of OpenSSL 3.1.4). The `openssl` code that Erlang/OTP vendors can be found in `./lib/erl_interface/src/openssl/` and `./erts/emulator/openssl/`. The OpenVEX statement claims that the code in those folders is not susceptible to `CVE-2023-6129`. The claim is towards **source code existing in Erlang/OTP**.
131+
132+
In other words, the `not_affected` status refers to the library that Erlang/OTP vendors for OpenSSL (the library that comes
133+
included with Erlang/OTP). If you build Erlang/OTP and link to any OpenSSL version (e.g., 3.5.2 or even 3.1.4) during the building process,
134+
your project has now a new build and runtime dependency and may be subject to `CVE-2023-6129`.
135+
136+
## Windows Binaries
137+
138+
For the time being, Erlang/OTP Windows binaries are not reported in the OpenVEX
139+
specification.
140+

0 commit comments

Comments
 (0)