[Pkg-puppet-devel] Bug#679765: puppetmaster - CA prone to MD5 collision attacks

[Bastian Blank]

Package: puppetmaster
Version: 2.7.14-1
Severity: grave

The included CA still only displays MD5 fingerprints of certificates.
MD5 is not longer save against collision attacks. So a rogue client is
able to use a collision attack to get a certificate for the puppet
master and overtake the clients.

Bastian

-- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.2.0-3-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash