The Heartbleed exploit (CVE-2014-0160) makes SSL connections using OpenSSL vulnerable to private key leakage.Does it mean that official update channels in RHEL/CentOS/etc. and Debian/Ubuntu shall be considered compromised?
Are Debian- and RedHat-style repositories compromised by Heartbleed OpenSSL bug?
debian;rhel;security;openssl
Packages and lists in the Debian / Ubuntu repositories are signed by GPG keys. The transport is not secured with SSL (packages are transferred over just over plain ftp or http). I am not that familiar with RHEL / CentOS, but if RPMs are signed too, then the same should apply.