Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certifi…
中危 CVSS 4.8
摘要
Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the…
中文摘要建设中，暂以英文摘要呈现（DR-003 v2）。
深度研判 · 自动通道
该漏洞尚未生成深度研判报告（DR-003 v2 AI pipeline 建设中）。
受影响产品
- :
Lint 边界警告 (1)
以下是本次研判 lint 阶段发现的非阻塞性警告（如引用 URL 未在白名单内）。这些不影响漏洞条目可用性，仅为透明度披露（参 DR-002）。
-
REF_URL_NOT_ALLOWLISTEDurl not in allowlist: https://www.erlang.org/doc/system/versions.html#order-of-versions
数据来源
- NVD DATABASE
原始链接
- https://cna.erlef.org/cves/CVE-2026-42789.html Third Party Advisory
- https://github.com/erlang/otp/commit/471cd2f664300a95353c467873800bbe706005db Patch
- https://github.com/erlang/otp/commit/59c8d824386b2eb1614ff9340624843ef6aca0fd Patch
- https://github.com/erlang/otp/security/advisories/GHSA-c99q-jmpx-v8qq Vendor Advisory
- https://osv.dev/vulnerability/EEF-CVE-2026-42789 Third Party Advisory
- https://www.erlang.org/doc/system/versions.html#order-of-versions Product
- https://access.redhat.com/errata/RHSA-2026:39809
- https://access.redhat.com/security/cve/CVE-2026-42789
- https://bugzilla.redhat.com/show_bug.cgi?id=2482093
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42789.json
时间线
- nvd_ingest NVD