newsNews: SSH keys weakness

 
 
Latest News
Mercurial hg moved to new server posted by agn, Thu Jan 12 15:07:50 2017 - 0 replies
Bazaar bzr moved to new server posted by agn, Tue Jan 10 03:33:35 2017 - 0 replies
Subversion svn service moved to the new server. posted by rwp, Fri Jan 6 19:02:03 2017 - 0 replies
The cvs service has moved to the new server posted by agn, Fri Dec 16 03:14:26 2016 - 0 replies
The git service has moved to the new server posted by rwp, Sun Dec 4 00:38:44 2016 - 0 replies
[184 news in archive]

SSH keys weakness

Item posted by Sylvain Beucler <Beuc> on Tue May 13 23:00:43 2008.

A vulnerability was discovered in Debian Etch's OpenSSL package:
http://lists.debian.org/debian-security-announce/2008/msg00152.html

This means that keys generated under this platform version are weak, and easily crackable.

Consequently we've run the dowkd.pl tool and disabled keys considered weak. They are marked as '# WEAK KEY' in the Savannah interface. Please remove or regenerate these keys (after upgrading your openssl package); we also suggest you look for other places where these keys were used, and replace them there too.

The Savannah SSH host keys (cvs/git/arch/download.savannah.gnu.org) predate Etch and are not impacted.

The savannah.gnu.org and savannah.nongnu.org https keys were generated through GnuTLS and are not impacted.

Comments:

No messages in SSH keys weakness

 

Back to the top


Powered by Savane 3.1-cleanup1