Bastian Blank <[email protected]> writes: > The included CA still only displays MD5 fingerprints of certificates. > MD5 is not longer save against collision attacks. So a rogue client is > able to use a collision attack to get a certificate for the puppet > master and overtake the clients.
Could you submit a bug in the upstream bug tracker at https://projects.puppetlabs.com/projects/puppet/issues, please? I'll connect your new upstream bug with this one, so we can track its status. Having the packaging team as a middleman for an upstream bug of this magnitute would probably not be constructive. -- Stig Sandbeck Mathisen -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
