From: Corinna Vinschen <corinna-cygwin@cygwin.com>
To: cygwin-apps@cygwin.com
Subject: Re: [SECURITY] p7zip: CVE-2015-1038
Date: Wed, 10 Feb 2016 10:40:00 -0000 [thread overview]
Message-ID: <20160210104031.GA14689@calimero.vinschen.de> (raw)
In-Reply-To: <BAY169-W1226B2C49C76FFFF5DE4282A7D60@phx.gbl>
[-- Attachment #1: Type: text/plain, Size: 905 bytes --]
On Feb 9 14:48, Tony Kelman wrote:
> >> I don't have anything for sourceware or cygwin.com in
> >> ~/.ssh/known_hosts, should I?
> >
> > In theory, yes. It's usually collected the first time you connect to
> > the host. The idea is to have a known key to compare the host against
> > to disallow MITM attacks.
>
> Hm okay, what's the best way to get this fixed then? Generate new
> ssh keys? Or someone else can NMU this since it's a security issue,
> my cygport including the new patch is at
> https://github.com/tkelman/cygwin-p7zip
I'm not sure in fact. The error you got was related to the host keys,
not the user keys. Changing the keys would probably not help, though
we can try that, of course. What means "NMU"?
Corinna
--
Corinna Vinschen Please, send mails regarding Cygwin to
Cygwin Maintainer cygwin AT cygwin DOT com
Red Hat
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 819 bytes --]
next prev parent reply other threads:[~2016-02-10 10:40 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-01-29 16:58 Yaakov Selkowitz
2016-01-29 20:11 ` Tony Kelman
[not found] ` <BAY169-W401D7F793D3E837DBF61F5A7DC0@phx.gbl>
2016-01-30 8:13 ` Tony Kelman
2016-02-08 13:54 ` Corinna Vinschen
2016-02-09 1:42 ` Tony Kelman
2016-02-09 10:40 ` Corinna Vinschen
2016-02-09 22:48 ` Tony Kelman
2016-02-10 10:40 ` Corinna Vinschen [this message]
2016-02-10 19:01 ` Achim Gratz
2016-02-11 3:59 ` Tony Kelman
2016-02-12 19:05 ` Achim Gratz
2016-02-13 6:53 ` Tony Kelman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20160210104031.GA14689@calimero.vinschen.de \
--to=corinna-cygwin@cygwin.com \
--cc=cygwin-apps@cygwin.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).