newsNews: SSH keys weakness

 
 
Latest News
OpenSSH DSA keys Deprecated posted by rwp, Fri 21 Jun 2019 09:34:25 PM UTC - 0 replies
Version Control System Storage Back-End Maintenance Complete posted by rwp, Fri 05 Apr 2019 10:15:05 PM UTC - 0 replies
Version Control System Downtime posted by rwp, Fri 05 Apr 2019 05:52:24 PM UTC - 0 replies
Version Control and Project Download Areas Maintenance Complete posted by rwp, Sat 30 Mar 2019 12:00:42 AM UTC - 0 replies

SSH keys weakness

Item posted by Sylvain Beucler <Beuc> on Tue 13 May 2008 11:00:43 PM UTC.

A vulnerability was discovered in Debian Etch's OpenSSL package:
http://lists.debian.org/debian-security-announce/2008/msg00152.html

This means that keys generated under this platform version are weak, and easily crackable.

Consequently we've run the dowkd.pl tool and disabled keys considered weak. They are marked as '# WEAK KEY' in the Savannah interface. Please remove or regenerate these keys (after upgrading your openssl package); we also suggest you look for other places where these keys were used, and replace them there too.

The Savannah SSH host keys (cvs/git/arch/download.savannah.gnu.org) predate Etch and are not impacted.

The savannah.gnu.org and savannah.nongnu.org https keys were generated through GnuTLS and are not impacted.

No messages in SSH keys weakness

 

Back to the top


Powered by Savane 3.5