Re: [Sks-devel] keyserver stats gathering

[Kristian Fiskerstrand]

On 02/24/2016 10:19 AM, Mire, John wrote:

> 
> The gossip, queries and stats traffic  is not a problem, according
> to Security, what they were questioning me about was the queries to
> the server flagging CVE-2014-3207 as a concern.  I had to look up
> this vuln and couldn't answer their questions.  I know I'm running
> >= 1.1.5 so I don't have to worry.  So if there are scripts being
> run against the server that should be whitelisted, it's not
> documented anywhere they could find, including the wiki and the
> associated links for source.

Heh,

Yeah, that'd be one of mine. SKS 1.1.5 is not affected, but there
possible server mitigations for lower versions so simple test is made:

https://git.sumptuouscapital.com/?p=sks-keyservers-pool.git;a=blob;f=sks-keyservers.net/status-srv/test_cve-2014-3207.sh;h=a4a959e67461cf2d68c23ed5a5dd161d693d87eb;hb=HEAD


-- 
----------------------------
Kristian Fiskerstrand
Blog: https://blog.sumptuouscapital.com
Twitter: @krifisk
----------------------------
Public OpenPGP key at hkp://pool.sks-keyservers.net
fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3
----------------------------
Aquila non capit muscas
The eagle does not hunt flies

signature.asc
Description: OpenPGP digital signature