http://www.openssh.com/txt/sshpam.adv came out on Sep23 with two new vulnerabilities that affect OpenSSH. Both these issues only affect OpenSSH 3.7 and 3.7.1. Red Hat Linux and Red Hat Enterprise Linux are not vulnerable to these issues as we ship with earlier versions (with the addition of backported security fixes for other issues). Keeping this bug open for a few days to enable users searching bugzilla to find out that they are not vulnerable.
Just to clarify the above comment, (for some /. readers), we have not shipped a vulnerable version of OpenSSH either with the OS originally, or as part of any update errata provided since. (See https://rhn.redhat.com/errata/RHSA-2003-279.html and https://rhn.redhat.com/errata/RHSA-2003-280.html for the most current OpenSSH updates, released on the 19th September).