OpenVEX in Erlang/OTP (testing phase)

A new Erlang announcement has been posted:

Hi everyone! As part of the Erlang/OTP vulnerability reporting efforts, Erlang/OTP is going to start testing the creation of OpenVEX statements for OTP 26, 27, and 28. This test with OpenVEX will be conducted on the master branch, under the vex statements folder. For now, do not trust the contents until we have finished our evaluation.

What is OpenVEX

OpenVEX is an implementation of the Vulnerability Exploitability Exchange (VEX).
OpenVEX statements will be published in this testing phase on a per release basis, meaning that we group statements per release.

Erlang/OTP OpenVEX files provide information about our own- and third-party vulnerabilities, e.g., pcre2, openssl, asmjit, etc. As an example:
{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://openvex.dev/docs/public/otp/vex-otp-27",
  "author": "vexctl",
  "timestamp": "2025-06-18T12:18:10.731951+02:00",
  "last_updated": "2025-06-18T12:18:16.706806968+02:00",
  "version": 19,
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2023-45853"
      },
      "timestamp": "2025-06-18T12:18:16.441327823+02:00",
      "products": [
        {
          "@id": "pkg:github/madler/zlib@04f42ceca40f73e2978b50e93806c2a18c1281fc"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present"
    },
...
In this statement, Erlang/OTP declares to not be vulnerable to CVE-2023-45853, which affected Zlib (commit on which Erlang/OTP vendors the Zlib version 04f42ceca40f73e2978b50e93806c2a18c1281fc). The statement declares that the vulnerable code is not present in Erlang/OTP. For the cases where Erlang/OTP is vulnerable, a remediation strategy can be provided in the OpenVEX statement.

As there is no good way to declared version ranges in the OpenVEX specification, Erlang/OTP prefers to opt for verbosity and conciseness rather than a loose format. As an example, CVE-2023-48795 is at the moment written as follows,
which mentions all OTP release versions affected as well as the applications versions.
{
      "vulnerability": {
        "name": "CVE-2023-48795"
      },
      "timestamp": "2025-06-18T12:18:04.385308178+02:00",
      "products": [
        {
          "@id": "pkg:otp/erlang@26.2"
        },
        {
          "@id": "pkg:otp/erlang@26.2.2"
        },
        {
          "@id": "pkg:otp/erlang@26.2.3"
        },
        {
          "@id": "pkg:otp/erlang@26.2.4"
        },
        {
          "@id": "pkg:otp/erlang@26.2.5"
        },
        {
          "@id": "pkg:otp/erlang@26.2.5.1"
        },
        {
          "@id": "pkg:otp/erlang@26.2.5.2"
        },
        {
          "@id": "pkg:otp/erlang@26.2.5.3"
        },
        {
          "@id": "pkg:otp/erlang@26.2.5.4"
        },
        {
          "@id": "pkg:otp/erlang@26.2.5.5"
        },
        {
          "@id": "pkg:otp/erlang@26.2.5.6"
        },
        {
          "@id": "pkg:otp/erlang@26.2.5.7"
        },
        {
          "@id": "pkg:otp/erlang@26.2.5.8"
        },
        {
          "@id": "pkg:otp/erlang@26.2.5.9"
        },
        {
          "@id": "pkg:otp/erlang@26.2.5.10"
        },
        {
          "@id": "pkg:otp/erlang@26.2.5.11"
        },
        {
          "@id": "pkg:otp/erlang@26.2.5.12"
        },
        {
          "@id": "pkg:otp/erlang@26.2.5.13"
        },
        {
          "@id": "pkg:otp/ssh@5.1"
        },
        {
          "@id": "pkg:otp/ssh@5.1.2"
        },
        {
          "@id": "pkg:otp/ssh@5.1.3"
        },
        {
          "@id": "pkg:otp/ssh@5.1.4"
        },
        {
          "@id": "pkg:otp/ssh@5.1.4.1"
        },
        {
          "@id": "pkg:otp/ssh@5.1.4.2"
        },
        {
          "@id": "pkg:otp/ssh@5.1.4.3"
        },
        {
          "@id": "pkg:otp/ssh@5.1.4.4"
        },
        {
          "@id": "pkg:otp/ssh@5.1.4.5"
        },
        {
          "@id": "pkg:otp/ssh@5.1.4.6"
        },
        {
          "@id": "pkg:otp/ssh@5.1.4.7"
        },
        {
          "@id": "pkg:otp/ssh@5.1.4.8"
        },
        {
          "@id": "pkg:otp/ssh@5.1.4.9"
        },
        {
          "@id": "pkg:otp/ssh@5.1.4.10"
        }
      ],
      "status": "affected",
      "action_statement": "Mitigation: If strict KEX availability cannot be ensured on both connection sides, affected encryption modes(CHACHA and CBC) can be disabled with standard ssh configuration. This will provide protection against vulnerability, but at a cost of affecting interoperability",
      "action_statement_timestamp": "2025-06-18T12:18:04.385308178+02:00"
    },
Scope of OpenVEX

It is important to understand that any claims that Erlang/OTP makes in OpenVEX refers to the actual source code included in OTP. For example, Erlang/OTP can claim to not be vulnerable to some openssl CVE because the openssl code that OTP vendors are not vulnerable. However, one can build OTP linking to openssl and be affected such CVE. The claims in the OpenVEX files are only related to Erlang/OTP source code

Erlang/OTP will do a new announcement once we have finished this testing phase.

Why is this important to me?

You do not need to act on this.

This announcement is important if you use vulnerability scanning tools on your software.
OpenVEX statements allows you to filter out false positives, and check if your Erlang/OTP is vulnerable (since we are reporting also vulnerabilities in these statements).

Original announcement:

Where Next?

Popular in Erlang News

News>Erlang News

EEF News & Announcements

This thread will be used to cross-post official EEF News via erlangforums.com. If you’d rather not see these alerts, you can mute the th...

#via-erlangforums #eef

4 321 2

2024-04-25 13:39:01 UTC

New

Ecto query using like/ilike in query

Good day to you all. I have been struggling to get a query involving like and ilike to work. Can anyone assist me on this, please? pro...

#ecto

17 16504 10

2022-09-15 19:56:29 UTC

New

Questions & Help>Questions

Proper use of Task.async?

As many of you may have realized by now (sorry for all the posts here) I’ve been working on a db problem where I’m trying to aggregate a ...

#task

26 15568 8

2019-07-09 19:11:03 UTC

New

Questions & Help>Questions

Using List.first instead of Enum.at(0)

I have seen a lot of code which picks the first element from a list using Enum.at(0) instead of List.first. Is there a reason why people ...

#code-style

76 33273 14

2022-10-26 22:41:44 UTC

New

Questions & Help>Questions

How to convert map to string (separated with ,)

Hello, I have map which I want to convert it to string like this: the map: %{last_name: "tavakkoli", name: "shahryar"} the string I ne...

#maps #strings

15 15491 2

2019-03-08 10:48:10 UTC

New

Questions & Help>Questions

Regex question for hyphen match

I’m not a pro in using Regex and can’t figure out why the following behaviour happens, especially if we take into account the difference ...

#learning-elixir

9 12939 10

2019-03-19 14:06:17 UTC

New

Questions & Help>Questions

How can I write a raw sql query?

Hi, I have to write a raw query for one of my project. But till now I have used ecto queries and don’t have much experience writing raw ...

/phoenix #ecto

13 19061 20

2020-04-12 00:15:10 UTC

New

OpenVEX in Erlang/OTP (testing phase)

erlangforums

OpenVEX in Erlang/OTP (testing phase)

Where Next?

Popular in Erlang News

Erlang/OTP 22.0 Release Candidate 2 has been released

Patch Package OTP 27.3.4.3 Released

Patch Package OTP 28.0.2 Released

Erlang OTP-24.0-rc2 released!

Erlang: A few notes on message passing

EEF News & Announcements

OTP 22 is released

Erlang OTP-23.3.4.7 released!

Erlang/OTP 20.0 is released

Erlang/OTP OTP-28.1 Released

Other popular topics

** (RuntimeError) could not lookup Ecto repo Repo because it was not started or it does not exist

How are you dealing with CSV files that uses CR line breaks?

How to set up the Elixir SDK in Intellij IDEA with the intellij-elixir plugin?

Ecto query using like/ilike in query

Proper use of Task.async?

Using List.first instead of Enum.at(0)

How to convert map to string (separated with ,)

How do I kill a process ` #PID<0.186.0` in iex?

Regex question for hyphen match

How can I write a raw sql query?

News>Erlang News

Latest on Elixir Forum

Categories:

Sub Categories:

Forums

We're in Beta

OpenVEX in Erlang/OTP (testing phase)

erlangforums

OpenVEX in Erlang/OTP (testing phase)

Where Next?

Popular in Erlang News

Erlang/OTP 22.0 Release Candidate 2 has been released

Patch Package OTP 27.3.4.3 Released

Patch Package OTP 28.0.2 Released

Erlang OTP-24.0-rc2 released!

Erlang: A few notes on message passing

EEF News & Announcements

OTP 22 is released

Erlang OTP-23.3.4.7 released!

Erlang/OTP 20.0 is released

Erlang/OTP OTP-28.1 Released

Other popular topics

** (RuntimeError) could not lookup Ecto repo Repo because it was not started or it does not exist

How are you dealing with CSV files that uses CR line breaks?

How to set up the Elixir SDK in Intellij IDEA with the intellij-elixir plugin?

Ecto query using like/ilike in query

Proper use of Task.async?

Using List.first instead of Enum.at(0)

How to convert map to string (separated with ,)

How do I kill a process ` #PID<0.186.0` in iex?

Regex question for hyphen match

How can I write a raw sql query?

News>Erlang News

Latest on Elixir Forum

Sponsor Spotlight

Our Sponsors

Categories:

Sub Categories:

Forums

Our Sponsors

We're in Beta