CVE-2011-0766

NameCVE-2011-0766
DescriptionThe random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which makes it easier for remote attackers to guess DSA host and SSH session keys.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs628456

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
erlang (PTS)buster1:21.2.6+dfsg-1fixed
buster (security)1:22.2.7+dfsg-1+deb10u1fixed
bullseye1:23.2.6+dfsg-1+deb11u1fixed
bookworm1:25.2.3+dfsg-1fixed
sid, trixie1:25.3.2.12+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
erlangsourcesqueeze1:14.a-dfsg-3squeeze1
erlangsource(unstable)1:14.b.3-dfsg-1low628456

Notes

http://www.kb.cert.org/vuls/id/178990
https://github.com/erlang/otp/commit/f228601de45c5

Search for package or bug name: Reporting problems