Fedora has issued an advisory on July 23, 2011: http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063218.html Mageia 2 is not affected; it was fixed in R14B03.
CC: (none) => n54
This message is a reminder that Mageia 1 is nearing its end of life. In approximately 25 days from now, Mageia will stop maintaining and issuing updates for Mageia 1. At that time this bug will be closed as WONTFIX (EOL) if it remains open with a Mageia 'version' of '1'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, simply change the 'version' to a later Mageia version prior to Mageia 1's end of life. Bug Reporter: Thank you for reporting this issue and we are sorry that we may not be able to fix it before Mageia 1 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Mageia, you are encouraged to click on "Version" and change it against that version of Mageia. Although we aim to fix as many bugs as possible during every release's lifetime, sometimes those efforts are overtaken by events. Often a more recent Mageia release includes newer upstream software that fixes bugs or makes them obsolete. -- Mageia Bugsquad
Severity: normal => major
Updated package uploaded for Mageia 1. Advisory: ======================== Updated erlang packages fix security vulnerability: The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which makes it easier for remote attackers to guess DSA host and SSH session keys (CVE-2011-0766). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0766 http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063218.html ======================== Updated packages in core/updates_testing: ======================== erlang-stack-R14B03-1.mga1 erlang-base-R14B03-1.mga1 erlang-devel-R14B03-1.mga1 erlang-manpages-R14B03-1.mga1 erlang-appmon-R14B03-1.mga1 erlang-dialyzer-R14B03-1.mga1 erlang-diameter-R14B03-1.mga1 erlang-edoc-R14B03-1.mga1 erlang-emacs-R14B03-1.mga1 erlang-jinterface-R14B03-1.mga1 erlang-asn1-R14B03-1.mga1 erlang-common_test-R14B03-1.mga1 erlang-compiler-R14B03-1.mga1 erlang-cosEvent-R14B03-1.mga1 erlang-cosEventDomain-R14B03-1.mga1 erlang-cosFileTransfer-R14B03-1.mga1 erlang-cosNotification-R14B03-1.mga1 erlang-cosProperty-R14B03-1.mga1 erlang-cosTime-R14B03-1.mga1 erlang-cosTransactions-R14B03-1.mga1 erlang-crypto-R14B03-1.mga1 erlang-debugger-R14B03-1.mga1 erlang-docbuilder-R14B03-1.mga1 erlang-erl_docgen-R14B03-1.mga1 erlang-erl_interface-R14B03-1.mga1 erlang-et-R14B03-1.mga1 erlang-eunit-R14B03-1.mga1 erlang-gs-R14B03-1.mga1 erlang-hipe-R14B03-1.mga1 erlang-inviso-R14B03-1.mga1 erlang-ic-R14B03-1.mga1 erlang-inets-R14B03-1.mga1 erlang-megaco-R14B03-1.mga1 erlang-mnesia-R14B03-1.mga1 erlang-observer-R14B03-1.mga1 erlang-odbc-R14B03-1.mga1 erlang-orber-R14B03-1.mga1 erlang-os_mon-R14B03-1.mga1 erlang-otp_mibs-R14B03-1.mga1 erlang-parsetools-R14B03-1.mga1 erlang-percept-R14B03-1.mga1 erlang-pman-R14B03-1.mga1 erlang-public_key-R14B03-1.mga1 erlang-reltool-R14B03-1.mga1 erlang-runtime_tools-R14B03-1.mga1 erlang-snmp-R14B03-1.mga1 erlang-ssh-R14B03-1.mga1 erlang-ssl-R14B03-1.mga1 erlang-syntax_tools-R14B03-1.mga1 erlang-test_server-R14B03-1.mga1 erlang-toolbar-R14B03-1.mga1 erlang-tools-R14B03-1.mga1 erlang-typer-R14B03-1.mga1 erlang-tv-R14B03-1.mga1 erlang-webtool-R14B03-1.mga1 erlang-wx-R14B03-1.mga1 erlang-xmerl-R14B03-1.mga1 from erlang-R14B03-1.mga1.src.rpm
Assignee: fundawang => qa-bugs
Testing complete on Mageia 1 i586 and x86-64. No poc, so just testing that the updates all install cleanly, and the erl shell is working. Could someone from the sysadmin team push the srpm erlang-R14B03-1.mga1.src.rpm from Mageia 1 Core Updates Testing to Core Updates. Advisory: pdated erlang packages fix security vulnerability: The random number generator in the Crypto application before 2.0.2.2, and SSH before 2.0.5, as used in the Erlang/OTP ssh library before R14B03, uses predictable seeds based on the current time, which makes it easier for remote attackers to guess DSA host and SSH session keys (CVE-2011-0766). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0766 http://lists.fedoraproject.org/pipermail/package-announce/2011-July/063218.html https://bugs.mageia.org/show_bug.cgi?id=7062
Keywords: (none) => validated_updateCC: (none) => davidwhodgins, sysadmin-bugsWhiteboard: (none) => MGA1-64-OK MGA1-32-OK
Update pushed: https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0338
Status: NEW => RESOLVEDCC: (none) => tmbResolution: (none) => FIXED