CVE-2019-1000014

Erlang/OTP Rebar3 versions 3.7.0–3.7.5 contain a Signing oracle vulnerability in Package registry verification that can allow code execution when victims fetch packages from a malicious/compromised mirror; fixed in 3.8.0.