Login
Login-Name Passwort


 
Newsletter
Werbung

Sicherheit: Verwendung schwacher Verschlüsselung in OpenSSL
Aktuelle Meldungen Distributionen
Name: Verwendung schwacher Verschlüsselung in OpenSSL
ID: DSA-3436-1
Distribution: Debian
Plattformen: Debian wheezy
Datum: Mo, 11. Januar 2016, 08:39
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7575

Originalnachricht

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3436-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
January 08, 2016 https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : openssl
CVE ID : CVE-2015-7575

Karthikeyan Bhargavan and Gaetan Leurent at INRIA discovered a flaw in
the TLS 1.2 protocol which could allow the MD5 hash function to be used
for signing ServerKeyExchange and Client Authentication packets during a
TLS handshake. A man-in-the-middle attacker could exploit this flaw to
conduct collision attacks to impersonate a TLS server or an
authenticated TLS client.

More information can be found at
https://www.mitls.org/pages/attacks/SLOTH

For the oldstable distribution (wheezy), this problem has been fixed
in version 1.0.1e-2+deb7u19.

For the stable distribution (jessie), the testing distribution (stretch)
and the unstable distribution (sid), this issue was already addressed in
version 1.0.1f-1.

We recommend that you upgrade your openssl packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWj9bhAAoJEAVMuPMTQ89EmUsP/1S7T1VbHI51eFKlFZCzqPot
UUz0GHpuBYyHrIJhVeBT4x5sLVufgCNRIEizdtea+UvsyClnXo1nSeyrPqUegAlj
u0egswS8M8cmmJ97SQ4/1AIaFsAepohW6n/ro9rTum6rwkEbfqXQPGZGMJ0SBg/f
lo5zrgQzNTYxIp70Ya9y0Pa2aBL9s+dgwDdg1eCJqk2c6qo5K1IW4JgEH/bFzB1X
fPHglmrNFIc4J4E7K9xkb1eHejZ2kBjVa+w8Yqu85xsTmhThEWLwuJ98m3/nIFLB
+lQQLNSmL1n37cF7BpPMCwzWgnFyGX3d19uynDFETuyGLLUbznkxTktkkxBjIfwL
G9F1YGQVd9eYkquKoyhr74W86nn20GYEBY13TUgwDsF0dDM53dXslK6xCJakbSFY
XEFlKV9VlwAza43WLDIKhBF1YDxmPoUrh7Xwfj6YFprGnk+pLfrGlqkH3T+WHfgU
FFFJimFi4IPJdVV59x4zKDh4S8baoX5/66L9bwf+K5eWJEJ/loNol0wRDqa+hQEr
ye507uk9UVFuxgHfWReKPN4OI8VcHQkZQ1VdQyuWSbbAZU+kvBDfTVjXZ1i9eSz7
B9EV0ACsMSBR5W3b5X+B8IqMB3grzQUj2ae9ESxLcVsAd83/grGu4SFaJMQDxfym
GahxEfEd17Acu+5bFxvQ
=cn6q
-----END PGP SIGNATURE-----
Pro-Linux
Traut euch!
Neue Nachrichten
Werbung