Language Selection

English French German Italian Portuguese Spanish

Red Hat Risk Reflex (The Linux Security Flaw That Isn't)

Filed under
Red Hat
Security

News headlines screaming that yet another Microsoft Windows vulnerability has been discovered, is in the wild or has just been patched are two a penny. Such has it ever been. News headlines declaring that a 'major security problem' has been found with Linux are a different kettle of fish. So when reports of an attack that could circumvent verification of X.509 security certificates, and by so doing bypass both secure sockets layer (SSL) and Transport Layer Security (TLS) website protection, people sat up and took notice. Warnings have appeared that recount how the vulnerability can impact upon Debian, Red Hat and Ubuntu distributions. Red Hat itself issued an advisory warning that "GnuTLS did not correctly handle certain errors that could occur during the verification of an X.509 certificate, causing it to incorrectly report a successful verification... An attacker could use this flaw to create a specially crafted certificate that could be accepted by GnuTLS as valid." In all, at least 200 operating systems actually use GnuTLS when it comes to implementing SSL and TLS and the knock-on effect could mean that web applications and email alike are vulnerable to attack. And it's all Linux's fault. Or is it?

Read more ►

More in Tux Machines

today's leftovers

  • The Linux Migration: April 2017 Progress Report
    In December 2016, I kicked off a migration to Linux (from OS X) as my primary laptop OS. In the nearly 4 months since the initial progress report, I’ve published a series of articles providing updates on things like which Linux distribution I selected, how I’m handling running VMs on my Linux laptop, and integration with corporate collaboration systems (here, here, and here). I thought that these “along the way” posts would be sufficient to keep readers informed, but I’ve had a couple of requests in the last week about how the migration is going. This post will help answer that question by summarizing what’s happened so far. Let me start by saying that I am actively using a Linux-powered laptop as my primary laptop right now, and I have been doing so since early February. All the posts I’ve published so far have been updates of how things are going “in production,” so to speak. The following sections describe my current, active environment.
  • Galago Pro: Look Inside
    Look inside the Galago Pro and see how easy it is to upgrade!
  • Direct3D 9 Over Vulkan Continues Progressing
  • Nouveau 1.0.15 X.Org Driver Released With Pascal Support
  • Arch Linux running natively on Pixel C
  • openSUSE Conference 2017 Schedule Posted

Making GNU/Linux Look Nice

Lumina Desktop Gets lumina-mediaplayer

  • 1.3.0 Development Preview: lumina-mediaplayer
  • Lumina Desktop Gets Its Own Media Player
    There's now yet another open-source media player, but this time focused on the BSD-focused Qt-powered Lumina Desktop Environment. Lumina Media Player is one of the new additions for the upcoming Lumina 1.3. Lumina Media Player's UI is quite simple so far and allows playing of local audio/video files along with basic audio streaming -- currently implemented for Pandora.

today's howtos