newsSavannah Administration - News: SSH keys weakness

 
 
Latest News
frontend upgraded posted by ineiev, Wed 31 Jan 2024 05:45:55 PM UTC
[download] SFTP disabled posted by ineiev, Mon 27 Nov 2023 11:00:33 AM UTC
git post-receive UDP syndication posted by carlc, Thu 31 Aug 2023 11:57:10 PM UTC
re-enabling reminders posted by ineiev, Tue 02 May 2023 11:40:13 AM UTC
frontend upgraded posted by ineiev, Fri 13 May 2022 06:43:50 AM UTC

SSH keys weakness

Item posted by Sylvain Beucler <Beuc> on Tue 13 May 2008 11:00:43 PM UTC.

A vulnerability was discovered in Debian Etch's OpenSSL package:
http://lists.debian.org/debian-security-announce/2008/msg00152.html

This means that keys generated under this platform version are weak, and easily crackable.

Consequently we've run the dowkd.pl tool and disabled keys considered weak. They are marked as '# WEAK KEY' in the Savannah interface. Please remove or regenerate these keys (after upgrading your openssl package); we also suggest you look for other places where these keys were used, and replace them there too.

The Savannah SSH host keys (cvs/git/arch/download.savannah.gnu.org) predate Etch and are not impacted.

The savannah.gnu.org and savannah.nongnu.org https keys were generated through GnuTLS and are not impacted.

 

Back to the top

Powered by Savane 3.13-cf05.
Corresponding source code