newsNews: SSH keys weakness

 
 
Show feedback again
Latest News
Bazaar upgraded posted by mjflick, Tue May 22 02:49:11 2012 - 0 replies
git / cgit updated posted by mjflick, Fri Dec 9 00:13:52 2011 - 0 replies
New Project Submissions Re-enabled posted by mjflick, Tue Nov 22 21:52:31 2011 - 0 replies
new project submissions disabled posted by karl, Thu Nov 10 00:27:27 2011 - 0 replies
news comments disabled posted by karl, Mon Sep 12 18:16:52 2011 - 0 replies
[171 news in archive]

SSH keys weakness

Item posted by Sylvain Beucler <Beuc> on Tue May 13 23:00:43 2008.

A vulnerability was discovered in Debian Etch's OpenSSL package:
http://lists.debian.org/debian-security-announce/2008/msg00152.html

This means that keys generated under this platform version are weak, and easily crackable.

Consequently we've run the dowkd.pl tool and disabled keys considered weak. They are marked as '# WEAK KEY' in the Savannah interface. Please remove or regenerate these keys (after upgrading your openssl package); we also suggest you look for other places where these keys were used, and replace them there too.

The Savannah SSH host keys (cvs/git/arch/download.savannah.gnu.org) predate Etch and are not impacted.

The savannah.gnu.org and savannah.nongnu.org https keys were generated through GnuTLS and are not impacted.

Comments:

No messages in SSH keys weakness

 

Show feedback again

Back to the top


Powered by Savane 3.1-cleanup