[maemo-developers] OpenSSH vulnerability and maemo extras upload accounts.

[From: olle]

On Fri, May 16, 2008 at 10:06:40PM +0200, Niels Breet wrote:
> 
> Recently a security issue has been found in Debian\'s implementation
> of OpenSSH as per CVE-2008-0166.

That should be OpenSSL, although OpenSSH uses OpenSSL for key creation.

> That directly affects openssh, and any key generated on Debian or
> Debian-derived systems from then until the recent security updates (on
> Debian, versions 0.9.8c-4etch3 or 0.9.8g-9) is deemed potentially
> compromised.

"then" being 0.9.8c-1 released 17 Sep 2006. If your key is older
than that you are not affected by this issue.

> If you have uploaded your key to garage.maemo.org and you believe this
> affects you: Please update your own version of OpenSSH and
> after that please re-generate a ssh key.

Again, please update your _OpenSSL_ library to current patchlevel.

/olle