CVE-2011-0766

Name: CVE-2011-0766
Creator: NVD / NIST
Published: 2011-05-31T20:55:01.78+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 3.05%

Last modified Jun 16, 2026

CVE-2011-0766 is a vulnerability of currently unknown severity. The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which makes it easier for remote attackers to guess DSA host and SSH session keys.. EPSS estimates a 3.05% chance of exploitation in the next 30 days.

Description

The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which makes it easier for remote attackers to guess DSA host and SSH session keys.

Metrics

EPSS Probability

3.05%

85.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-310

Affected Software

Vendor	Product	Versions
Erlang	Crypto	<= 2.0.2.1
Erlang	Erlang\/Otp	r11b-5
Erlang	Erlang\/Otp	r12b-5
Erlang	Erlang\/Otp	r13b
Erlang	Erlang\/Otp	r13b02-1
Erlang	Erlang\/Otp	r13b03
Erlang	Erlang\/Otp	r13b04
Erlang	Erlang\/Otp	r14a
Erlang	Erlang\/Otp	r14b
Erlang	Erlang\/Otp	r14b01
Erlang	Erlang\/Otp	r14b02
Ssh	Ssh	<= 2.0.4

References

http://secunia.com/advisories/44709Vendor Advisory
http://www.kb.cert.org/vuls/id/178990Patch, Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/47980Third Party Advisory, VDB Entry
https://github.com/erlang/otp/commit/f228601de45c5b53241b103af6616453c50885a5Patch
http://secunia.com/advisories/44709Vendor Advisory
http://www.kb.cert.org/vuls/id/178990Patch, Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/47980Third Party Advisory, VDB Entry
https://github.com/erlang/otp/commit/f228601de45c5b53241b103af6616453c50885a5Patch

Timeline

Published: May 31, 2011
Last Modified: Jun 16, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2011-0766?

How severe is CVE-2011-0766?

Severity scoring for CVE-2011-0766 is pending analysis. The EPSS model estimates a 3.05% probability of exploitation in the next 30 days.

How do I fix CVE-2011-0766?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2011-0766?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST