I think it would be irresponsible to provide MD2-signed certificates.
The discussion is dated 2009. I think ca-certificates should provide
neither MD2 nor MD5 root certificates. And MD2 verification should be
unsupported in the crypto lib anyway (see CVE-2009-2409).

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2009-2409

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1031333

Title:
  Missing Verisign certs due to broken extract script

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ca-certificates/+bug/1031333/+subscriptions

-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to