newsNews: SSH keys weakness

 
 
Latest News
Savannah https SSL Certificates Updated posted by rwp, Thu 06 Mar 2014 09:11:43 AM UTC - 0 replies
Bazaar upgraded posted by mjflick, Tue 22 May 2012 02:49:11 AM UTC - 0 replies
git / cgit updated posted by mjflick, Fri 09 Dec 2011 12:13:52 AM UTC - 0 replies
New Project Submissions Re-enabled posted by mjflick, Tue 22 Nov 2011 09:52:31 PM UTC - 0 replies
new project submissions disabled posted by karl, Thu 10 Nov 2011 12:27:27 AM UTC - 0 replies
[172 news in archive]

SSH keys weakness

Item posted by Sylvain Beucler <Beuc> on Tue 13 May 2008 11:00:43 PM UTC.

A vulnerability was discovered in Debian Etch's OpenSSL package:
http://lists.debian.org/debian-security-announce/2008/msg00152.html

This means that keys generated under this platform version are weak, and easily crackable.

Consequently we've run the dowkd.pl tool and disabled keys considered weak. They are marked as '# WEAK KEY' in the Savannah interface. Please remove or regenerate these keys (after upgrading your openssl package); we also suggest you look for other places where these keys were used, and replace them there too.

The Savannah SSH host keys (cvs/git/arch/download.savannah.gnu.org) predate Etch and are not impacted.

The savannah.gnu.org and savannah.nongnu.org https keys were generated through GnuTLS and are not impacted.

Comments:

No messages in SSH keys weakness

 

Back to the top


Powered by Savane 3.1-cleanup