diff options
author | Colin Watson <cjwatson@ubuntu.com> | 2014-02-09 16:09:50 +0000 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2014-02-09 16:17:31 +0000 |
commit | 8909ff0e3cd07d1b042d1be1c8b8828dbf6c9a83 (patch) | |
tree | ebee4092f1411059e34da6f66b4ebd64f4411020 /sshd.8 | |
parent | 07f2a771c490bd68cd5c5ea9c535705e93bd94f3 (diff) |
Reject vulnerable keys to mitigate Debian OpenSSL flaw
In 2008, Debian (and derived distributions such as Ubuntu) shipped an
OpenSSL package with a flawed random number generator, causing OpenSSH to
generate only a very limited set of keys which were subject to private half
precomputation. To mitigate this, this patch checks key authentications
against a blacklist of known-vulnerable keys, and adds a new ssh-vulnkey
program which can be used to explicitly check keys against that blacklist.
See CVE-2008-0166.
Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1469
Last-Update: 2013-09-14
Patch-Name: ssh-vulnkey.patch
Diffstat (limited to 'sshd.8')
-rw-r--r-- | sshd.8 | 1 |
1 files changed, 1 insertions, 0 deletions
@@ -954,6 +954,7 @@ The content of this file is not sensitive; it can be world-readable. | |||
954 | .Xr ssh-agent 1 , | 954 | .Xr ssh-agent 1 , |
955 | .Xr ssh-keygen 1 , | 955 | .Xr ssh-keygen 1 , |
956 | .Xr ssh-keyscan 1 , | 956 | .Xr ssh-keyscan 1 , |
957 | .Xr ssh-vulnkey 1 , | ||
957 | .Xr chroot 2 , | 958 | .Xr chroot 2 , |
958 | .Xr hosts_access 5 , | 959 | .Xr hosts_access 5 , |
959 | .Xr login.conf 5 , | 960 | .Xr login.conf 5 , |