Context: PHP Remote code execution.

Link to Lemmy thread

Just make sure not to get MITM'd by someone whose secret key password is "4".

Switch them off or take them offline first. No point in exposing them to unknown exploits.

There’s a PHP rce issue, and a ca cert issue, both going around right now. Good times.

Don't worry, they've changed their key. It's "5" now.

ca cert issue is a lot harder to exploit than a lot of people are acting. ... Not that it magically makes it less important to fix, but perhaps a reason to not let the stress rise just yet.

Not the password. The key. The entire key (excluding metadata) is 0b100.

Yep, that's what we did. Waiting for je patched builds to finish now.

“Astonishingly, the private keys were 4, 56, 66, 115, 155, 156, 230, [and ] 237.”

I was thinking of upgrading my servers recently to get away from a very old Ubuntu version. Good thing I waited.

Mastodon is all over with this too.

How is this even possible btw? Doesn’t the private key have to match the public key? Surely this would have been noticed earlier if it had a short public key as well?

They use Cryptographic hash functions, so the actual key length is not reflected in the resulting hash length.

Cryptographic hash functions are functions that take a variable-length input and return a fixed-length output, which can be used in, for example, a digital signature.

how is that good?

Because now I don’t need to SSH into the damn thing again.

I’m lazy.

This is why i steered out of cybersecurity

It would interest me to do research to find exploits, or red team / pen testing type stuff. But incident response seems pretty stressful.

Yea. I don't think most normies, not even most home server nerds have much real exposure to this particular vulnerability.

So everyone, go harden your infrastructure, because it's the right thing to do, not just because of this.

It's Five 5s, uncrackable.