The Heartbleed exploit (CVE-2014-0160) makes SSL connections using OpenSSL vulnerable to private key leakage.

Does it mean that official update channels in RHEL/CentOS/etc. and Debian/Ubuntu shall be considered compromised?


1 Answer 1


Packages and lists in the Debian / Ubuntu repositories are signed by GPG keys. The transport is not secured with SSL (packages are transferred over just over plain ftp or http). I am not that familiar with RHEL / CentOS, but if RPMs are signed too, then the same should apply.

  • 3
    RPMs are indeed signed with GPG. Apr 8, 2014 at 8:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .