TinyIPA build is subject to MITM due to lack of HTTPS for mirrors
Bug #1581112 reported by
Mathieu Mitchell
This bug affects 2 people
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| ironic-python-agent |
Triaged
|
High
|
Unassigned | ||
Bug Description
The current TinyIPA build is subject to a man-in-the-middle attack because binaries are fetched over plain old HTTP.
There doesn't seem to be any official Tiny Core Linux mirrors offering HTTPS.
This applies to the initial fetching of kernel/ramdisk, but also to package installation within the chroot (using tce-load). There is a possibility that tce-load verifies checksums from metadata files, but those are fetched over HTTP as well, making it vulnerable to attacks.
Revision history for this message
| Dmitry Tantsur (divius) wrote | #1 |
| Changed in ironic-python-agent: | |
| status: | New → Triaged |
| importance: | Undecided → High |
| summary: |
- TinyIPA build is subject to MITM + TinyIPA build is subject to MITM due to lack of HTTPS for mirrors |
Revision history for this message
| Mathieu Mitchell (mat128) wrote | #2 |
To post a comment you must log in.
We need infra mirrors for real. Not sure how infra will fetch these things though, it would be still HTTP..