newsNews: SSH keys weakness

 
 
Latest News
The git service has moved to the new server posted by rwp, Sun Dec 4 00:38:44 2016 - 0 replies
Savannah is migrating to updated systems. posted by rwp, Wed Nov 30 23:56:33 2016 - 0 replies
Savannah suffering networking problems posted by rwp, Fri May 13 22:58:25 2016 - 0 replies
Savannah https SSL certificates updated posted by rwp, Fri Mar 25 05:32:10 2016 - 0 replies
Savannah IPv4 address has changed posted by rwp, Sun Aug 9 20:07:57 2015 - 0 replies
[180 news in archive]

SSH keys weakness

Item posted by Sylvain Beucler <Beuc> on Tue May 13 23:00:43 2008.

A vulnerability was discovered in Debian Etch's OpenSSL package:
http://lists.debian.org/debian-security-announce/2008/msg00152.html

This means that keys generated under this platform version are weak, and easily crackable.

Consequently we've run the dowkd.pl tool and disabled keys considered weak. They are marked as '# WEAK KEY' in the Savannah interface. Please remove or regenerate these keys (after upgrading your openssl package); we also suggest you look for other places where these keys were used, and replace them there too.

The Savannah SSH host keys (cvs/git/arch/download.savannah.gnu.org) predate Etch and are not impacted.

The savannah.gnu.org and savannah.nongnu.org https keys were generated through GnuTLS and are not impacted.

Comments:

No messages in SSH keys weakness

 

Back to the top


Powered by Savane 3.1-cleanup