Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

The incovation of the apt_key module should use the full key-id #1

Open
sebastianriese opened this issue Apr 23, 2018 · 0 comments
Open

Comments

@sebastianriese
Copy link

This is potentially unsafe:

- name: apt-key
  apt_key:
    keyserver: keys.gnupg.net
    id: 8825FD82
    state: present

It is relatively easy to generate a key that matches a 32-bit key-id, so an attacker could supply an impostor key to the key-server. The id argument allows the full fingerprint to be supplied as id (see the examples here https://docs.ansible.com/ansible/latest/modules/apt_key_module.html).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant