Unscored severity · published May 31, 2011
CVE-2011-0766
The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on…
–
CVSS
3.1%
EPSS
No
On KEV
Description
The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which makes it easier for remote attackers to guess DSA host and SSH session keys.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.1% · higher than 88% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CR
Crypto · Erlang
through 2.0.2.1 · source: NVD
ER
Erlang/otp · Erlang
r11b-5; r12b-5; r13b; r13b02-1; r13b03; r13b04; +4 more · source: NVD
SS
Ssh · Ssh
through 2.0.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-0766
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-0766
Vendor Advisory
http://secunia.com/advisories/44709
Patch
http://www.kb.cert.org/vuls/id/178990
Third Party Advisory
http://www.securityfocus.com/bid/47980
Patch
https://github.com/erlang/otp/commit/f228601de45c5b53241b103af6616453c50885a5