<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:11.0pt;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="#467886" vlink="#96607D" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">Hello,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">I have a question regarding Erlang Debian Package Version 1:25.2.3+dfsg-1+deb12u1.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">We noticed a discrepancy with the package version number and the underlying Erlang/OTP Version and we wondered if this is by purpose or if there might
by a mistake here.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">We came across this when using a vulnerability scanner for CVE-2025-32433. On the Debian page (<a href="https://security-tracker.debian.org/tracker/CVE-2025-32433">https://security-tracker.debian.org/tracker/CVE-2025-32433</a></span><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">
and <a href="https://tracker.debian.org/news/1640554/accepted-erlang-12523dfsg-1deb12u1-source-into-stable-security/">
https://tracker.debian.org/news/1640554/accepted-erlang-12523dfsg-1deb12u1-source-into-stable-security/</a>)</span><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"> it says, that the Package Version 1:25.<span style="background:yellow;mso-highlight:yellow">2.3</span>+dfsg-1+deb12u1
patches the vulnerability but the underlying Erlang/OTP Version has the Version Number 25.<span style="background:yellow;mso-highlight:yellow">3.2</span>.20 . Because of this difference in the version numbers the vulnerability scanner is not able to detect
that the patched version is installed because it compares the Debian package version to the original Erlang/OTP Version.
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">Is this discrepancy in version number by purpose or is it maybe a mistake and will the versions be aligned in a new package soon?
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black">I hope I am reaching the responsible person for my question here, otherwise could you forward my question or give me a hint where I have to ask?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black;mso-fareast-language:DE">Kind regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black;mso-fareast-language:DE">Tara Dommershausen<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black;mso-fareast-language:DE">___________________________________________________<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black;mso-fareast-language:DE"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black;mso-fareast-language:DE">i. A. Tara Dommershausen<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black;mso-fareast-language:DE">Technical Consultant Information Security
<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black;mso-fareast-language:DE">Competence Center Security | Offensive Security<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black;mso-fareast-language:DE"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black;mso-fareast-language:DE">Controlware GmbH<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black;mso-fareast-language:DE">Waldstrasse 92, 63128 Dietzenbach, Germany<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black;mso-fareast-language:DE">E-Mail: tara.dommershausen@controlware.de
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:black;mso-fareast-language:DE">___________________________________________________<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
Controlware GmbH | Telefon: +49 6074 858-00 | Fax: +49 6074 858-108 | E-Mail: info@controlware.de | https://www.controlware.de | Sitz: 63128 Dietzenbach | Registergericht: Offenbach a.M., HRB Nr. 6431 | Geschäftsführer: Bernd Schwefing, Michael Küchen, Dr.
Marc Wilczek | Aufsichtsratsvorsitzender: Christof Ziegler
</body>
</html>