From the upstream advisory [1]: During code migration a bug was introduced in PolarSSL 0.99-pre4. As a result the generation of Diffie Hellman value X is weak on the client and server. Only a part of the value X is filled with random data, instead of the whole value. (Determined by the server Diffie Hellman parameters). In addition, MPI primes are only generated within a limited subspace of the full prime space. Again only a part of the prime is filled with random data, instead of the whole value. Impact When a weak X is generated the resulting Diffie Hellman key exchange is weaker. This makes it easier for an attacker to brute force the private value and thus the master secret. When the master secret is known, an attacker is able to modify and read all data in the secure channel. MPI primes generated with mpi_gen_prime() are less secure. If rsa_gen_key() was used to generate RSA keys with PolarSSL, these keys are less secure as well. This only affects keys / primes generated within affected versions of PolarSSL, not keys generated in older versions or imported keys. Resolution PolarSSL version 1.1.2 contains a fix for the bug and generates full-size values of X and primes. If you generated primes or RSA keys from within PolarSSL, re-generate and replace those primes / keys. [1] http://polarssl.org/trac/wiki/SecurityAdvisory201201
Created tracking bugs for polarssl: fedora-17 [bug 822642]
Fedora 17 currently has polarssl 1.1.3, so this is fixed.