Re: timestamp of the signature of Debian 12 netinst

2023-06-23 Thread Jeremy Stanley
On 2023-06-23 20:59:07 +0200 (+0200), Julian Schreck wrote: > Where to find the former? (Or do I not need it for checking the > integrity of the download(s)?) [...] > > > [1] : https://www.debian.org/CD/verify, e. g. 2011-01-05 [SC] [...] Please restate your question more precisely if this doesn't

Re: c-ares, CVE-2023-31147, CVE-2023-31124

2023-06-23 Thread Anton Gladky
Thank you all for your replies! @Moritz, could you please create an issue with a the possible proposal, how it should look like? Best regards Anton Am Fr., 23. Juni 2023 um 20:49 Uhr schrieb Ola Lundqvist : > > Hi Anton, all > > Well even if there are some systems affected I must say that if >

Re: c-ares, CVE-2023-31147, CVE-2023-31124

2023-06-23 Thread Ola Lundqvist
Hi Anton, all Well even if there are some systems affected I must say that if someone have removed urandom the behavior described is expected. I mean /dev/urandom is there for a reason. And yes there are better functions than rand() but I can hardly see this as a vulnerability. Or well it is, but

Re: timestamp of the signature of Debian 12 netinst

2023-06-23 Thread Julian Schreck
Where to find the former? (Or do I not need it for checking the integrity of the download(s)?) -- > On Fri, 2023-06-23 at 16:53 +0200, Julian Schreck wrote: > > I was downloading the netimage of bookworm, the signing key(s) and > > sha sums when I noticed that my timestamp of the signature [0] > >

Re: timestamp of the signature of Debian 12 netinst

2023-06-23 Thread Jonathan Wiltshire
On 23 June 2023 15:53:08 BST, Julian Schreck wrote: >Dear all, >I was downloading the netimage of bookworm, the signing key(s) and sha sums >when I noticed that my timestamp of the signature [0] differs from the one on >the website. [1] >Is this a security issue or just a website not updated? >

Re: timestamp of the signature of Debian 12 netinst

2023-06-23 Thread Adam D. Barratt
On Fri, 2023-06-23 at 16:53 +0200, Julian Schreck wrote: > I was downloading the netimage of bookworm, the signing key(s) and > sha sums when I noticed that my timestamp of the signature [0] > differs from the one on the website. [1] > Is this a security issue or just a website not updated? > You

Re: Securing Debian Manual too old?

2023-06-23 Thread Konstantin Khomoutov
On Fri, Jun 23, 2023 at 12:40:19PM +0200, Stephan Seitz wrote: > I found the Securing Debian Manual > (https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html). > This version is from 2017. > > It has „Chapter 6. Automatic hardening of Debian systems” which mentions > Harden packa

timestamp of the signature of Debian 12 netinst

2023-06-23 Thread Julian Schreck
Dear all, I was downloading the netimage of bookworm, the signing key(s) and sha sums when I noticed that my timestamp of the signature [0] differs from the one on the website. [1] Is this a security issue or just a website not updated? Kind regards Julian -- [0] : $ LC_ALL=C gpg --verify-files

Securing Debian Manual too old?

2023-06-23 Thread Stephan Seitz
Hi! I found the Securing Debian Manual (https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html). This version is from 2017. It has „Chapter 6. Automatic hardening of Debian systems” which mentions Harden packages and Bastille. None of these packages exist anymore in Debian

Re: c-ares, CVE-2023-31147, CVE-2023-31124

2023-06-23 Thread Moritz Muehlenhoff
On Fri, Jun 23, 2023 at 06:48:23AM +0200, Anton Gladky wrote: > Hi, > > two CVEs might be irrelevant for Debian systems. Can they be > tagged as "unaffected"? Or we have some systems, where > /dev/urandom is not existing? They are already marked as non-issues: CVE-2023-31124 (c-ares is an asynch