newsNews: SSH keys weakness

 
 
Latest News
Savannah VCS Storage Maintenance Completed posted by rwp, Wed 14 May 2014 10:19:51 PM UTC - 0 replies
Savannah VCS Maintenance posted by rwp, Sun 11 May 2014 08:05:38 PM UTC - 0 replies
Savannah https SSL Certificates Updated posted by rwp, Thu 06 Mar 2014 09:11:43 AM UTC - 0 replies
Bazaar upgraded posted by mjflick, Tue 22 May 2012 02:49:11 AM UTC - 0 replies
git / cgit updated posted by mjflick, Fri 09 Dec 2011 12:13:52 AM UTC - 0 replies
[174 news in archive]

SSH keys weakness

Item posted by Sylvain Beucler <Beuc> on Tue 13 May 2008 11:00:43 PM UTC.

A vulnerability was discovered in Debian Etch's OpenSSL package:
http://lists.debian.org/debian-security-announce/2008/msg00152.html

This means that keys generated under this platform version are weak, and easily crackable.

Consequently we've run the dowkd.pl tool and disabled keys considered weak. They are marked as '# WEAK KEY' in the Savannah interface. Please remove or regenerate these keys (after upgrading your openssl package); we also suggest you look for other places where these keys were used, and replace them there too.

The Savannah SSH host keys (cvs/git/arch/download.savannah.gnu.org) predate Etch and are not impacted.

The savannah.gnu.org and savannah.nongnu.org https keys were generated through GnuTLS and are not impacted.

Comments:

No messages in SSH keys weakness

 

Back to the top


Powered by Savane 3.1-cleanup