6

The Heartbleed exploit (CVE-2014-0160) makes SSL connections using OpenSSL vulnerable to private key leakage.

Does it mean that official update channels in RHEL/CentOS/etc. and Debian/Ubuntu shall be considered compromised?

Improve this question
0

1 Answer 1

Reset to default
6

Packages and lists in the Debian / Ubuntu repositories are signed by GPG keys. The transport is not secured with SSL (packages are transferred over just over plain ftp or http). I am not that familiar with RHEL / CentOS, but if RPMs are signed too, then the same should apply.

Improve this answer
1
  • 3
    RPMs are indeed signed with GPG.
    – Deer Hunter
    Commented Apr 8, 2014 at 8:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .