Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. Improper Certificate Validation vulnerability in hexpm hex_core allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hex_core's default HTTP adapter on Erlang/OTP 24, or on OTP 25 when the operating system's CA certificates can't be loaded. hex_core:default_config/0 selects the built-in hex_http_httpc adapter. For an HTTPS request whose adapter config has no ssl option, hex_http_httpc:http_options/2 builds options that verify the server certificate against public_key:cacerts_get/0. When that call raises, the adapter prints a warning and sends the request without ssl options, so httpc uses the defaults of the ssl application, which before OTP 26 don't verify the server certificate. public_key:cacerts_get/0 doesn't exist on OTP 24, so every HTTPS request falls back there, and on OTP 25 it raises when no CA store is found. hex_core versions before 0.11.0 never set ssl options, so they don't verify the server certificate on OTP 25 and earlier whether or not a CA store is found. The fallback was intended and documented, but the documentation didn't make clear that it meant no certificate verification. Since hex_core 0.8.2 the README has warned that the built-in httpc adapter "has insecure default settings" and recommended other HTTP clients, and the adapter prints "using default ssl options which are insecure" on every request that falls back. hex_core 0.11.0 added certificate verification with the changelog entry "Use secure SSL defaults for OTP 25+". Neither the README nor the warning says that the server certificate isn't verified, the README doesn't say which OTP versions the warning applies to, and on OTP 25 without CA certificates the warning tells users to upgrade to OTP 25 or later, which they already run. This advisory is published so that users who took those notices as general advice know their HTTPS requests weren't authenticated. This issue affects hex_core: from 0.1.0 before 0.20.0.
hex_core 0.21.1, which contains the fix, is available for F44 and later: - Rawhide: erlang-hex_core-0.21.1-1.fc46 (stable) - F45: FEDORA-2026-b514ab4cac (erlang-hex_core-0.21.1-1.fc45) - F44: FEDORA-2026-b300043748 (erlang-hex_core-0.21.1-1.fc44) Older versions are not exploitable on Fedora in any case. The insecure fallback, which connects without TLS options, is only taken if public_key:cacerts_get/0 fails. On OTP 26 and later, the ssl default is verify_peer, so such a connection fails rather than skipping certificate verification. The advisory itself limits the impact to OTP 24/25. F43 (hex_core 0.19.0 on OTP 26) is therefore not affected and will not be updated before its EOL.
FEDORA-2026-b300043748 (erlang-hex_core-0.21.1-1.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-b300043748
FEDORA-2026-b514ab4cac (erlang-hex_core-0.21.1-1.fc45) has been submitted as an update to Fedora 45. https://bodhi.fedoraproject.org/updates/FEDORA-2026-b514ab4cac
FEDORA-2026-b514ab4cac (erlang-hex_core-0.21.1-1.fc45) has been pushed to the Fedora 45 stable repository. If problem still persists, please make note of it in this bug report.
FEDORA-2026-b300043748 (erlang-hex_core-0.21.1-1.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report.