Subject: Re: [vserver] OpenSSL: various distributions on debian hosts affected or not?
From: "Jeffrey 'jf' Lim" <jfs.world@gmail.com>
Date: Fri, 16 May 2008 09:55:52 +0800
Fri, 16 May 2008 09:55:52 +0800
On Fri, May 16, 2008 at 5:52 AM, Daniel Hokka Zakrisson <daniel@hozac.com>
wrote:

> Guenther Fuchs wrote:
> > Hi there,
> >
> > today various forms of announcements made the vulnerability of debian
> > openssl packages public, messages sounded like this:
> >
> > --- snip ---
> > A severe vulnerability was found in the random number generator (RNG)
> > of the Debian OpenSSL package, starting with version 0.9.8c-1 (and
> > similar packages in derived distributions such as Ubuntu). ...
> > --- snap ---
> >
> > My question to that is: Is it possible, that guests using different
> > distributions (example Fedora or RedHat) on Debian hosts are affected
> > by that?
>
> As long as you haven't used your guests' DSA keys from the host, you
> should be safe. (From what I understand, anyway. I haven't read any of the
> advisories too carefeully.)
>
> > I would guess no as there are different libraries used inside, but I'm
> > not too far into that technical things ;-)
> >
>

Your security is only as good as the weakest link.

-Jeff

--
In the meantime, here is your PSA:
"It's so hard to write a graphics driver that open-sourcing it would not
help."
-- Andrew Fear, Software Product Manager, NVIDIA Corporation
http://kerneltrap.org/node/7228


On Fri, May 16, 2008 at 5:52 AM, Daniel Hokka Zakrisson <daniel@hozac.com> wrote:
Guenther Fuchs wrote:
> Hi there,
>
> today various forms of announcements made the vulnerability of debian
> openssl packages public, messages sounded like this:
>
> --- snip ---
> A severe vulnerability was found in the random number generator (RNG)
> of the Debian OpenSSL package, starting with version 0.9.8c-1 (and
> similar packages in derived distributions such as Ubuntu). ...
> --- snap ---
>
> My question to that is: Is it possible, that guests using different
> distributions (example Fedora or RedHat) on Debian hosts are affected
> by that?

As long as you haven't used your guests' DSA keys from the host, you
should be safe. (From what I understand, anyway. I haven't read any of the
advisories too carefeully.)

> I would guess no as there are different libraries used inside, but I'm
> not too far into that technical things ;-)
>

Your security is only as good as the weakest link.

-Jeff

--
In the meantime, here is your PSA:
"It's so hard to write a graphics driver that open-sourcing it would not help."
-- Andrew Fear, Software Product Manager, NVIDIA Corporation
http://kerneltrap.org/node/7228