Early last week, while working to improve our UI, we discovered a security vulnerability in the open-source NervesHub platform.

Upon investigation, this security issue had been present for over three years. And after further investigation, we found a different security issue which had appeared 11 months ago.

We promptly fixed both issues and updated NervesCloud so that all our users and their devices were protected. And then, together with the Erlang Ecosystem Foundation, we put together a comprehensive security advisory, so it is transparently documented.

We have taken further steps to improve our test suite and are working on additional changes to help ensure these issues don’t recur.

Please read the Security Advisory on GitHub for more information.

And if you have any questions, comments, or feedback, please contact us at hello@nervescloud.com