Bastian Blank <wa...@debian.org> writes: > The included CA still only displays MD5 fingerprints of certificates. > MD5 is not longer save against collision attacks. So a rogue client is > able to use a collision attack to get a certificate for the puppet > master and overtake the clients.
Could you submit a bug in the upstream bug tracker at https://projects.puppetlabs.com/projects/puppet/issues, please? I'll connect your new upstream bug with this one, so we can track its status. Having the packaging team as a middleman for an upstream bug of this magnitute would probably not be constructive. -- Stig Sandbeck Mathisen -- To UNSUBSCRIBE, email to debian-bugs-rc-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
