Re: [vserver] OpenSSL: various distributions on debian hosts affected or not?

From: Jeffrey 'jf' Lim <jfs.world_at_gmail.com>
Date: Fri 16 May 2008 - 02:55:52 BST
Message-ID: <4b3125cc0805151855w3ed66a4dy6dff3f7692d37eeb@mail.gmail.com>

On Fri, May 16, 2008 at 5:52 AM, Daniel Hokka Zakrisson <daniel@hozac.com>
wrote:

> Guenther Fuchs wrote:
> > Hi there,
> >
> > today various forms of announcements made the vulnerability of debian
> > openssl packages public, messages sounded like this:
> >
> > --- snip ---
> > A severe vulnerability was found in the random number generator (RNG)
> > of the Debian OpenSSL package, starting with version 0.9.8c-1 (and
> > similar packages in derived distributions such as Ubuntu). ...
> > --- snap ---
> >
> > My question to that is: Is it possible, that guests using different
> > distributions (example Fedora or RedHat) on Debian hosts are affected
> > by that?
>
> As long as you haven't used your guests' DSA keys from the host, you
> should be safe. (From what I understand, anyway. I haven't read any of the
> advisories too carefeully.)
>
> > I would guess no as there are different libraries used inside, but I'm
> > not too far into that technical things ;-)
> >
>

Your security is only as good as the weakest link.

-Jeff

--
In the meantime, here is your PSA:
"It's so hard to write a graphics driver that open-sourcing it would not
help."
-- Andrew Fear, Software Product Manager, NVIDIA Corporation
http://kerneltrap.org/node/7228
Received on Fri May 16 02:56:17 2008
[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Fri 16 May 2008 - 02:56:21 BST by hypermail 2.1.8