Re: /home/putnopvut/asa/AST-2008-007/AST-2008-007: AST-2008-007 Cryptographic keys generated by OpenSSL on Debian-based systems compromised

[Florian Weimer <fw () deneb enyo de>]

* Asterisk Security Team:

>    +------------------------------------------------------------------------+
>    | Resolution | Since this is not a vulnerability in Asterisk itself but  |
>    |            | in a tool that Asterisk uses, there will be no new        |
>    |            | releases made; however, users who are affected by the     |
>    |            | Debian OpenSSL vulnerability are strongly encouraged to   |
>    |            | upgrade their package of OpenSSL to an uncompromised      |
>    |            | version (version 0.9.8c-4 or later) and regenerate all    |
>    |            | keys used by Asterisk.                                    |
>    +------------------------------------------------------------------------+

Correction: The first fixed version are 0.9.8c-4etch3 (on the
etch/stable branch) and 0.9.8g-9 (for sid/unstable and lenny/testing).
Plain 0.9.8c-4 (and 0.9.8c-4etch1 and 0.9.8c-4etch2) are vulnerable.