4 ms·

* CVE-2019-16905: https://www.cvedetails.com/cve/CVE-2019-16905/ https://www.cvedetails.com/cve/CVE-2019-16905/ * CVE-2016-10012: https://www.cvedetails.com/cv

• traceroute66 5y ago
  The 2019 bug refers to a bug in an explicitly experimental area of SSH code (post-quantum crypto XMSS) most of the other server-side bugs on the list relate to non-standard configs (of varying obscurity) the fact that - in an era of increasingly hostile cyber threats - years had gone by without any serious threats says it all really. for most people, they should just run normal SSH, enable public-key only authentication and get on with their lives. I see no reason why anyone should jump ship to some shiny new untested ssh server. Especially as , when others have pointed out, the people behind OpenSSH are the same people behind OpenBSd and LibreSSL.
  • staticassertion 5y ago
    There are obviously more than just those tho. Not that I really disagree with the conclusion. There's not a ton of pre-auth attack surface.
• rileyphone 5y ago
  For reference, the first is with an experimental feature, second is a local privilege escalation, and the third allowed a malicious server to read the clients keys. For comparison, here's some CVEs from software written in Go: Caddy CVE: https://www.cvedetails.com/cve/CVE-2018-21246/ https://www.cvedetails.com/cve/CVE-2018-21246/ Kubernetes CVEs: https://www.cvedetails.com/vulnerability-list/vendor_id-15867/product_id-34016/Kubernetes-Kubernetes.html https://www.cvedetails.com/vulnerability-list/vendor_id-1586... No silver bullets! Though some have less lead in them. OpenSSH, along with other software developed by OpenBSD, has earned the highest level of trust in something written in C. C can be dangerous, but there is a chasm between such careful works and the typical offenders like OpenSSL (OpenBSD's alternative is LibreSSL, confusingly).