Individual skill
evo-erlang-ssh-cve-patch
Identifies and patches CVE-2025-32433 in Erlang/OTP SSH server source code by inserting an authentication-state check in ssh_connection.erl that rejects connection protocol messages (IDs >= 80) received before authentication is complete.
tasks-evolved/fix-erlang-ssh-cve/environment/skills/evo-erlang-ssh-cve-patch/SKILL.md
Source commit 84ca182da055fafb6453dcec4a6defdbbfd987c1
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Local scripts
- Last checked
- Nov 6, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 97
- Repository last updated
- Sep 10, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- agent-skills Repository topic
- ai-agents Repository topic
- llm-agents Repository topic
- open-world Repository topic
- self-evolving-agents Repository topic
- security Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 3,114 bytesSKILL.mdcore · 3,114 bytesSKILL.mdcore · 3,114 bytesscripts/patch_ssh_connection.pyruns · 7,133 bytesscripts/run_patch.pyruns · 2,932 bytesscripts/utils.pyruns · 5,408 bytes
Read excerpt
# evo-erlang-ssh-cve-patch
## Overview
CVE-2025-32433 is a critical (CVSS 10.0) pre-authentication Remote Code Execution vulnerability in Erlang/OTP SSH server. The server fails to validate authentication state before processing SSH connection protocol messages (message IDs >= 80), allowing attackers to execute arbitrary commands without credentials.
## Vulnerability Details
- **Root Cause**: `ssh_connection.erl`'s `handle_msg/4` function processes channel messages (SSH_MSG_CHANNEL_OPEN, SSH_MSG_CHANNEL_REQUEST) without checking if `#ssh{authenticated}` is true
- **Attack Vector**: After completing key exchange, attacker sends SSH_MSG_CHANNEL_OPEN (ID 90) + SSH_MSG_CHANNEL_REQUEST (ID 98) with exec type, bypassing authentication entirely
- **Affected Versions**: All Erlang/OTP versions before 27.3.3, 26.2.5.11, 25.3.2.20
## The Fix
Add a pattern-matching clause in `ssh_connection.erl` that catches ANY message when `authenticated = false` on the server side, returning a disconnect error. This clause must be placed BEFORE any channel message handlers but is naturally placed after any disconnect handler.
### Exact Erlang Code to Insert