What happened with Fedora - and Red Hat too

The Fedora Project has sent out an update describing its "infrastructure issues" in some detail. Yes, it was a security breach. "One of the compromised Fedora servers was a system used for signing Fedora packages. However, based on our efforts, we have high confidence that the intruder was not able to capture the passphrase used to secure the Fedora package signing key. Based on our review to date, the passphrase was not used during the time of the intrusion on the system and the passphrase is not stored on any of the Fedora servers." They are changing the signing keys anyway.

Red Hat, too, suffered a breach, which has been disclosed in this openssh update notice. "In connection with the incident, the intruder was able to sign a small number of OpenSSH packages relating only to Red Hat Enterprise Linux 4 (i386 and x86_64 architectures only) and Red Hat Enterprise Linux 5 (x86_64 architecture only). As a precautionary measure, we are releasing an updated version of these packages..."

Full Story (comments: 38)