Erlang OTP-25.1 released!

NewsBot · 21 September 2022 11:14

Erlang OTP-25.1 has been released.

OTP 25.1

Erlang/OTP 25.1 is the first maintenance patch package for OTP 25, with mostly bug fixes as well as quite many small improvements.

Below are some highlights of the release:

crypto:

Crypto is now considered to be usable with the OpenSSL
3.0 cryptolib for production code.
ENGINE and FIPS are not yet fully functional.

Changed the behaviour of the engine load/unload
functions

ssl:

A vulnerability has been discovered and corrected. It
is registered as CVE-2022-37026 “Client Authentication
Bypass”. Corrections have been released on the
supported tracks with patches 23.3.4.15, 24.3.4.2, and
25.0.2. The vulnerability might also exist in older OTP
versions. We recommend that impacted users upgrade to
one of these versions or later on the respective
tracks. OTP 25.1 would be an even better choice.
Impacted are those who are running an ssl/tls/dtls
server using the ssl application either directly or
indir…

Link: Release OTP 25.1 · erlang/otp · GitHub