6

The Heartbleed exploit (CVE-2014-0160) makes SSL connections using OpenSSL vulnerable to private key leakage.

Does it mean that official update channels in RHEL/CentOS/etc. and Debian/Ubuntu shall be considered compromised?

Gilles 'SO- stop being evil'
  • 807,993
  • 194
  • 1,674
  • 2,175
Deer Hunter
  • 1,866
  • 3
  • 20
  • 26

1 Answers1

6

Packages and lists in the Debian / Ubuntu repositories are signed by GPG keys. The transport is not secured with SSL (packages are transferred over just over plain ftp or http). I am not that familiar with RHEL / CentOS, but if RPMs are signed too, then the same should apply.

Lekensteyn
  • 20,173
  • 18
  • 71
  • 111