CVE-2011-0766

NameCVE-2011-0766
DescriptionThe random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which makes it easier for remote attackers to guess DSA host and SSH session keys.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs628456

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
erlang (PTS)bullseye1:23.2.6+dfsg-1+deb11u1fixed
bullseye (security)1:23.2.6+dfsg-1+deb11u2fixed
bookworm1:25.2.3+dfsg-1+deb12u3fixed
bookworm (security)1:25.2.3+dfsg-1+deb12u1fixed
trixie1:27.3.4.1+dfsg-1fixed
forky, sid1:27.3.4.3+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
erlangsourcesqueeze1:14.a-dfsg-3squeeze1
erlangsource(unstable)1:14.b.3-dfsg-1low628456

Notes

http://www.kb.cert.org/vuls/id/178990
https://github.com/erlang/otp/commit/f228601de45c5
Search for package or bug name: Reporting problems