Bug#657046: alpine: Alpine uses DES-56 in violation of RFC 5751

[gregor herrmann]

Control: tag -1 + fixed-upstream patch

On Mon, 23 Jan 2012 13:38:15 -0500, Robert Tomsick wrote:

> This issue was reported upstream and a patch produced 
> (http://sourceforge.net/tracker/index.php?func=detail&aid=3428168&group_id=264924&atid=1128048),
>  

In the meantime committed in upstream master:
http://re-alpine.git.sourceforge.net/git/gitweb.cgi?p=re-alpine/re-alpine;a=commit;h=e2eef589799d742ea6ccaec9144dc619a516222e

Cheers,
gregor

-- 
 .''`.  Homepage: http://info.comodo.priv.at/ - OpenPGP key 0xBB3A68018649AA06
 : :' : Debian GNU/Linux user, admin, and developer  -  http://www.debian.org/
 `. `'  Member of VIBE!AT & SPI, fellow of the Free Software Foundation Europe
   `-   NP: Peter Jones: The coffee song


signature.asc
Description: Digital signature

Bug#657046: alpine: Alpine uses DES-56 in violation of RFC 5751

[Robert Tomsick]

Package: alpine
Version: 2.02-3.1
Severity: normal


alpine (re-alpine) uses DES-56 to encrypt S/MIME messages.  This is very 
insecure by modern standards and is in violation of RFC 5751.

This issue was reported upstream and a patch produced 
(http://sourceforge.net/tracker/index.php?func=detail&aid=3428168&group_id=264924&atid=1128048),
 
but has not been addressed in a release of re-alpine.  The patch on the 
linked page changes the default encryption algorithm to AES-128 (CBC 
mode), which is sufficiently strong for modern use.

Due to the security issues surrounding the use of DES-56 in 2012, I 
believe this should be patched in the alpine package even if re-alpine 
does not produce a release with the patch.

-- System Information:
Debian Release: 6.0.3
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.1.10-grsec (SMP w/2 CPU cores; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages alpine depends on:
ii  libc6   2.11.2-10Embedded GNU C Library: Shared lib
ii  libgssapi-krb5-21.8.3+dfsg-4squeeze5 MIT Kerberos runtime libraries - k
ii  libkrb5-3   1.8.3+dfsg-4squeeze5 MIT Kerberos runtime libraries
ii  libldap-2.4-2   2.4.23-7.2   OpenLDAP libraries
ii  libncurses5 5.7+20100313-5   shared libraries for terminal hand
ii  libpam0g1.1.1-6.1+squeeze1   Pluggable Authentication Modules l
ii  libssl0.9.8 0.9.8o-4squeeze5 SSL shared libraries

Versions of packages alpine recommends:
ii  alpine-doc2.02-3.1   Text-based email client's document

Versions of packages alpine suggests:
ii  aspell   0.60.6-4GNU Aspell spell-checker
ii  exim44.72-6+squeeze2 metapackage to ease Exim MTA (v4) 
ii  exim4-daemon-light [mail 4.72-6+squeeze2 lightweight Exim MTA (v4) daemon

-- no debconf information



-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org