Bug#481106: marked as done (openssh-server: Please add ssh-vulnkey to help test for bad keys)
Your message dated Wed, 14 May 2008 02:05:19 +0100
with message-id <20080514010518.GH16645@riva.ucam.org>
and subject line Re: Bug#481106: openssh-server: Please add ssh-vulnkey to help test for bad keys
has caused the Debian Bug report #481106,
regarding openssh-server: Please add ssh-vulnkey to help test for bad keys
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@bugs.debian.org
immediately.)
--
481106: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=481106
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems
--- Begin Message ---
Package: openssh-server
Version: 1:4.3p2-9
Severity: important
The fix for bug 363516 fails to include ssh-vulnkey that is in the ubuntu version.
(See http://www.ubuntu.com/usn/usn-612-2 )
The seriousness of this bug means that a method for testing for the vulenability
is important to include with the fix.
Perhaps it would be a good idea to run ssh-vulnkey as part of the update process?
--- End Message ---
--- Begin Message ---
On Tue, May 13, 2008 at 01:05:13PM -0500, Karl Schmidt wrote:
> Package: openssh-server
> Version: 1:4.3p2-9
> Severity: important
>
> The fix for bug 363516 fails to include ssh-vulnkey that is in the ubuntu version.
The update just hasn't made it into the Debian stable-security queue yet
for awkward reasons. It's in Debian unstable, and will be in
stable-security as soon as the security team manages to get it
published. Filing bugs won't make it happen faster. :-)
> (See http://www.ubuntu.com/usn/usn-612-2 )
Note that I was involved in both the Debian and Ubuntu sides of this
process, and applied identical changes to both distributions.
> Perhaps it would be a good idea to run ssh-vulnkey as part of the
> update process?
It does for host keys. It's not practical to do for user keys (and not
remotely obvious what could automatically be done about it), but the
upgrade does recommend it.
Cheers,
--
Colin Watson [cjwatson@debian.org]
--- End Message ---
Reply to: