[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5212ECFF.3050100@redhat.com>
Date: Mon, 19 Aug 2013 22:13:51 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Landon Hurley <ljrhurley@...il.com>
Subject: Re: PostgreSQL insecure install via yum (multiple
problems)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 08/19/2013 07:04 PM, Landon Hurley wrote:
> Kurt Seifried <kseifried@...hat.com> wrote:
>> Problem:
>
>> So I wanted to install PostgreSQL 9.2 to test something. So I
>> google "postgresql 9.2 rpm" and get sent to:
>
>> http://yum.postgresql.org/repopackages.php
>
>> which is not available by HTTPS at all. Not ideal but ok, I
>> download it over HTTP because I can check the signature on the
>> file right?
>
>> Wrong, I can't find the key anywhere. I try pgp.mit.edu, I even
>> google site:postgresql.org 442df0f8 and all you get are archived
>> emails with the warning that the signature can't be checked. No
>> copy of the key.
>
> Kurt, pgp.mit.edu is deprecated. I recommend searching 0x442df0f8
> on pool.sks-keyservers.net which does return a key.
>
> landon
Weird, I must have typo'ed it, in any event it returns a key with that
value and no signatures. No idea if it's legitimate or not. I can
check it against an RPM I downloaded over HTTP which sort of ends me
back up square one.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (GNU/Linux)
iQIcBAEBAgAGBQJSEuz/AAoJEBYNRVNeJnmT3UYP/j3UkEnVw+Yp2VT1N7HbVgzv
p/P3ZoFCOxyv801RmkbhGTgvFXwAYewKvFzEKh55xiCCuoKTarbyeO84SpsEkxV7
WQizj0pwPBTnCQFDEcAkG1tiPYXiyMXb24QcpRivox7XlrAFyzqE8KNiYxNaWngi
ZznFQpenSJgWBpI/F8VqLntOi62Y/DPjJ2yGX0ZHrA/HvG0s7ov5CTr35l4IBYjc
J3lCu4mLonbagpFZHWPUMqWQtQvfE02EhfRCOHuU13u9ugrXE755pHQ7/9pTW9wg
GAEcNpNC2m4aXpiQfxYga2MI6oELED8Kg56vIwxsdpc6WT6JgqsqdczxG4C6Ooqc
9HxDIke0Y8umXa4WtfAtLneDL2HI9fU5cGYq4ZCs46+rLFr5I552vHzybyjAcQkN
5UjZJsGPTh9x48aY9WADtWE30AS5XGIecIn4Nec27TKxpY0jc4lUsTbepG0aitRn
44Q7LX2moAn3cCWoy0hPFZZMdUcAxSJDdUnSRGQhxKwfYhCxJ8YhQpRZ0Z3sKOac
nGh1wEa1VUDBiUrmTiyv9VS/3Hemjh1rL9TgbfBYYpBtCFLo6UmWZssyJMlumf35
4LqzoOEUeLLScTHMclDwHtm33iNCAsO/a/zwJMN1IzyYGaJRreHWcYReIx9/yVP3
iuQmwEOYYTr/5BVMww5C
=d7so
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
