[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240330214617.fzevnlz4nrqvgbwp@sym.noone.org>
Date: Sat, 30 Mar 2024 22:46:17 +0100
From: Axel Beckert <abe@...xchevaux.org>
To: Andres Freund <andres@...razel.de>
Cc: oss-security@...ts.openwall.com
Subject: Re: Re: backdoor in upstream xz/liblzma leading to
ssh server compromise
Hi Andres,
On Sat, Mar 30, 2024 at 12:48:50PM -0700, Andres Freund wrote:
> FWIW, RSA_public_decrypt is reachable, regardless of server configuration,
> when using certificate based authentication.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Wait, do you really mean SSH keys verified by certificates issued by a
(usually internal, SSH-specific) certificate authority (CA) for a key?
See e.g.
https://en.wikibooks.org/wiki/OpenSSH/Cookbook/Certificate-based_Authentication
what certificate-based authentication in SSH actually means.
From my experience certificate-based SSH authentication (i.e. those
algorithms with *-cert-* in their names) is rather rare, while simple
public key authentication (where you just put your according pubkey
into .ssh/authorized_keys) is very common.
Can you clarify if you really meant that solely certificate based
authentication (with certificates issued by a CA) triggers that code
path or if you actually meant all sorts of public key based
authentication in general?
Kind regards, Axel
--
PGP: 2FF9CD59612616B5 /~\ Plain Text Ribbon Campaign, http://arc.pasp.de/
Mail: abe@...xchevaux.org \ / Say No to HTML in E-Mail and Usenet
Mail+Jabber: abe@...ne.org X
https://axel.beckert.ch/ / \ I love long mails: https://email.is-not-s.ms/
Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
